To create a few test accounts during the evaluation period, use the Manually Add Users steps.

Transcription

1 Once you complete the Essentials for Office 365 Wizard, the Essentials page displays in Barracuda Cloud Control. Click Set up additional domains to go to the Barracuda Security Service Domains page, or continue with your configuration. BARRACUDA SECURITY SERVICE Step 1. Set Up User Accounts You can add users manually, or use LDAP or Azure AD authentication to automatically synchronize the Barracuda Security Service with your active directory server. To create a few test accounts during the evaluation period, use the Manually Add Users steps. Manually Add Users Click to manually add users Go to Users > Add/Update Users: 2. In the User Accounts field, enter each user address for the domain on a separate line, and then select from the following options: 1. Enable User Quarantine All s for the user which meet the configured block policy go to the user's quarantine account. Depending on how you have configured the quarantine notification interval on the Users > Quarantine Notification page, the user receives a quarantine digest at a specified time. From the Users > Quarantine Notification page you can also enable the user to set their own quarantine notification interval. 2. Notify New Users When set to Yes, users receive a welcome once the account is created. 3. Click Save Changes. The users are added to the Users > Users List table where you can select from the following actions: 1. Edit Click to specify domains this user can manage. 2. Reset Click to send the user an with instructions on how to reset their account password. 3. Log in as this user Click to view or change the user's settings (for example, quarantine notifications), view/manage the domains this user manages, and view/search/manage the user's Message Log. 4. Delete Click to remove the user account. 1 / 31

2 The first time the Barracuda Security Service receives an Allowed for a non-existent user at a domain configured for the service, if that same recipient receives a second 1-6 days later, a new user account is created. This method of new account creation does not use LDAP lookup, and the user receives an from the Barracuda Security Service with their login information so they can access their quarantine account. Automatically Add Users You can configure user authentication via your organization's LDAP server or Azure AD service. For complete setup details, see the following articles: How to Configure User Authentication with Azure AD How to Configure User Authentication Using LDAP Step 2. Add Additional Domains Use the steps in this section only if you want to manually add additional domains, otherwise, go to Step 3. Create Transport Rule. Click to add additional domains... Obtain the hostname: Log in to the Office 365 admin center. In the left pane, click Settings > Domains. In the Domains table, click on your domain. Take note of the hostname. This is the address of your destination mail server, for example, cudawarecom.mail.protection.outlook.com Enter the hostname: Barracuda recommends using a hostname rather than an IP address so that you can move the destination mail server and update DNS records without making changes to the Barracuda Security Service configuration. This address indicates where the Barracuda Security Service should direct inbound mail from the Internet to your Office 365 Exchange server. For example, your domain displays to the Internet as: bessdomain.mail.protection.outlook.com 2 / 31

3 1. Log in to the Barracuda Security Service as administrator, and click Domains, and click Add Domain. 2. Enter the domain name and destination mail server hostname obtained from your Office 365 account in the dialog box. 3. Click Add; the Domain Settings page displays. Step 3. Create Transport Rule 1. Log in to the Office 365 admin center, and go to Admin centers > Exchange. 2. In the left pane, click mail flow, and click rules. 3. Click the + symbol, and click Bypass spam filtering: 4. In the new rule page, enter a Name to represent the rule. 5. From the Apply this rule drop-down menu, select The sender > IP address is in any of these ranges or exactly matches: 3 / 31

4 6. In the specify IP address ranges page, type the IP address range for the Sender (Barracuda Security Service) based on your Barracuda Security Service instance, for example, type: /20, and click the + symbol. 7. Type the next IP address range for the Sender, for example, type /21, and click the + symbol: 8. Click OK. 9. Click Save. The list of mail flow rules displays. 10. Select the rule you just created, and click the edit icon to display the properties. 4 / 31

5 11. Scroll to the bottom and change the Priority of the rule to 0. This ensures it is the first rule to process. 12. Click Save. Step 4. Restrict Inbound Mail to the Barracuda Security Service IP Range (Optional) Important: After updating your MX records, allow 24 hours before completing the steps in this section to allow the records to propagate. Use the following steps if you want to restrict inbound mail to the Barracuda Security Service IP address range: Click to restrict inbound mail Log in to the Office 365 admin center, and go to Admin centers > Exchange. In the left pane, click mail flow, and click rules. Click the + symbol, and click Create a new rule. In the new rule page, enter a Name to represent the rule. For example, type: Barracuda ESS IP restriction Scroll down and click More Options. From the Apply this rule if drop-down menu, select The Sender > Is External/Internal > Outside the organization. From the Do the following drop-down menu, select Reject this message with the explanation. Enter the message you want included in the non-delivery report (NDR) that is sent to the sender. For example, enter: You have attempted to bypass our Security Service. Please ensure your DNS is up-to-date and try sending your message again. Click Add Exception. 10. Select The Sender > Sender s IP address is in any of these ranges or exactly matches, and enter the Barracuda Security Service IP range based on your Barracuda Security Service instance Enter the Barracuda Security Service IP range, for example: /20 Click the + symbol. Enter the Barracuda Security Service IP range, for example: /21 Click the + symbol. Click OK. Select Stop processing more rules. Under Match sender address in message, select Envelope. Click Save. The list of mail flow rules displays. Select the rule you just created, and click the edit icon to bring up the properties. Scroll to the bottom and change the Priority of the rule to 0. This ensures it is the first rule to process. Click Save. If you complete both Step 3. Create Transport Rule and Step 4. Restrict Inbound Mail to the Barracuda Security Service IP Range, verify the Restrict Inbound Mail from Outside Your Organization to the Barracuda Security Service IP Range rule displays first in the mail flow rules list, and the Transport Rule rule displays second in the mail flow rule list. Step 5. Configure Outbound Mail If you have multiple domains within your Office 365 tenant and you want to scan only certain domains 5 / 31

6 outbound, see How to Configure Office 365 to Scan Only Selected Domains Outbound. If you have not already done so, contact Barracuda Technical Support and request that Outbound Groups be enabled on your Barracuda Security Service account. 1. Log in to the Barracuda Security Service, click Domains, and click on the domain name to toggle the MX Records configuration; make note of the Outbound Hostname. 2. Log in to the Office 365 admin center, and go to Admin centers > Exchange. 3. In the left pane, click mail flow, and click connectors. 4. Click the + symbol and use the wizard to create a new connector. 5. From the From drop-down menu, select Office 365, and from the To drop-down menu, select Partner organization: 6. Enter a Name and (optional) Description to identify the connector: 6 / 31

7 7. Click Next. Select Only when messages are sent to these domains, click the + symbol, and enter an asterisk (*) in the add domain field: 7 / 31

8 8. Click OK, and click Next. Select Route through these smart hosts, and click the + symbol. 9. Go to the Barracuda Security Service, click the Domains tab, and click on the domain name to toggle the MX records configuration. Copy your outbound hostname, and enter it in the add smart host page: 8 / 31

9 10. Click Save, and click Next. Use the default setting, Always use Transport Layer Security (TLS) to secure the connection (recommended) > Issued by Trusted certificate authority (CA): 9 / 31

10 11. Click Next. In the confirmation page, verify your settings and click Next. Office 365 runs a test to verify your settings: 10 / 31

11 12. When the verification page displays, enter a test address, and click Validate. Once the verification is complete, your mail flow settings are added. For additional configuration options and features, log in to the web interface and click Help. Step 6. Configure Sender Policy Framework for Outbound Mail To assure Barracuda Networks is the authorized sending mail service of outbound mail from your Barracuda Security Service, add the following to the Sender Policy Framework (SPF) record INCLUDE line of the SPF record for your sending mail server for each domain sending outbound mail. Select the relevant SPF INCLUDE based on the region you selected for your Barracuda Security Service. For example, if you are using Office 365, your record would look similar to: v=spf1 include:spf.protection.outlook.com include:spf.ess.barracudanetworks.com -all See Sender Authentication for more information. 11 / 31

12 If you have an SPF record set up for your domain, edit the existing record, and add the following to the INCLUDE line for each domain sending outbound mail based on your Barracuda Security Service instance. For example: include:spf.ess.barracudanetworks.com -all If you do not have an SPF record set up for your domain, use the following value to create a TXT record that creates a HARDFail SPF for your domain based on your Barracuda Security Service instance. For example: v=spf1 include:spf.ess.barracudanetworks.com -all See Sender Policy Framework for Outbound Mail for INCLUDE values based on your Barracuda Security Service instance. ADVANCED THREAT PROTECTION Files blocked by Advanced Threat Protection (ATP) display on the Overview > Dashboard page. 1. Go to ATP Settings, and select the desired option: Deliver First, then Scan Attachments are delivered with the message to the recipient and then scanned by the ATP service; if a virus is detected, an notification is sent to the recipient. Additionally, if Notify Admin is set to Yes, and a virus is detected in the scanned attachment, an is sent to the administrator. Scan First, then Deliver Attachments are scanned by the ATP service before delivery. If a virus is detected in the attachment the message is blocked, otherwise it is delivered to the recipient. 2. Select whether to Notify Admin if a virus is detected in a scanned attachment. When set to Yes, enter the ATP Notification address in the associated field. When ATP is set to either Deliver First, then Scan or Scan First, then Deliver, you can exempt sender addresses, sender domains, recipient addresses, recipient domains, or sender IP addresses from ATP scanning in the ATP Exemptions section on the ATP Settings page. BARRACUDA CLOUD ARCHIVING SERVICE Step 1. Add Users to Your Barracuda Cloud Control Account Add users through AD authentication and associate a role and whose mail can be viewed with an AD user or group, or manually configure and assign roles to local accounts in the web interface. Understanding Roles User Able only to view messages accessible to the account, either because the username for the account is also that of the sender or recipient of a message, or because it has been given explicit access to view an address via Alias Linking. Auditor Able to create and activate policies, and view, search, and export any messages to/from the domains to which they have access. Additionally, Auditors can save and name an Advanced search for reexecution at a later time from the Saved Searches tab. To create a "Domain Auditor" (an auditor with access to only a subset of the domains on your Barracuda Cloud Archiving Service), set the role to Auditor and specify at least one domain. If no domains are specified, then all messages in the entire Barracuda Cloud Archiving Service are accessible. No auditor account has access to any system or network configuration information on the Barracuda Cloud Archiving Service. Admin Able to view all items from any user, not just those listed for the account. Also able to create and activate policies, and can make other system or network changes. Active Directory Configuration Use AD authentication to store and administer Barracuda Cloud Archiving Service user accounts via your organization's LDAP or Azure AD. 12 / 31

13 Add LDAP Active Directory Click here to configure LDAP Active Directory... Use the following steps to set up Barracuda Cloud Control LDAP authentication: 1. Log in to as the account administrator, and go to Admin >Directories. 2. Click Add Directory > LDAP Active Directory; the Create Directory wizard displays. In the Info page, specify the following details: 1. Enter a name to represent the directory in the Directory Name field. 2. Toggle User / Group Sync to On to synchronize with AD. 3. Toggle Authenticate to On to allow users to authenticate using their LDAP AD credentials. When toggled Off, users must authenticate using their Barracuda Cloud Control credentials. 4. Optionally, enter the administrator contact address. 3. Click Save & Continue. 4. In the Host page, enter the following details for your LDAP host: 1. LDAP Host IP address 2. LDAP Host Port 3. Base domain name 4. Username 5. Password 6. Select the Connection Security as STARTTLS, LDAPS, or None. 5. Click Add Domain; the domain is added to the Domains field. Click Verify. 6. Click Test to verify connectivity. If the connection is successful, Connected displays. If the connection fails, verify the entered LDAP host details. Click Continue. 7. In the Domains page, click Add domain to add the domain to the AD configuration. Complete this step for each domain you want to add. 8. To verify you own the domains you plan to include in your AD configuration, select the manner in which to verify the domains: Copy a META tag to your domain header, or Add a TXT record to your host's DNS management settings 13 / 31

14 9. Click Verify. Once the domain is verified, it is added to the Directories table in the Admin > Directories page in Barracuda Cloud Control. Add Azure Active Directory Click here to configure Azure Active Directory... See also: Azure AD with Active Directory Federation Services Use the following steps to set up Barracuda Cloud Control Azure AD authentication: 1. Log in to as the account administrator, and go to Admin > Directories. 2. Click Add Directory > Azure Active Directory; the Create Directory wizard displays. In the Info page, enter a name to represent the directory in the Directory Name field. 3. Click Connect to Microsoft to sign in to Microsoft and authorize Barracuda Cloud Control to connect to your Azure AD account. 4. Once authorization is complete, toggle User / Group Sync to On to synchronize with Azure AD. 14 / 31

15 5. Toggle Authenticate to On to allow users to authenticate using their Azure AD credentials. When toggled Off, users must authenticate using their Barracuda Cloud Control credentials. 6. Optionally, enter the administrator contact address. Click Save & Continue. 7. Once verification is complete, your Azure AD domains display in the wizard. Click Done. Associate a Role 1. Go to the Users > LDAP User Add/Update page. 2. In the LDAP User/Group field, enter the User or Group name to which the permissions apply. 3. Select the Role for the specified user or group account: 1. User Role Specify mailbox addresses to include or exclude from the account: Include these Addresses Enter a mailbox address that you wish to make available to the specified account, and then click Add. Exclude these Addresses Enter a mailbox address that you wish to hide from the specified account, and then click Add. 2. Auditor Role Configure the desired permissions: Domains Enter a domain for which the auditor can view mail, and then click Add. Saved Search Define Saved Searches on the Basic > Search page, and then select the desired Saved Search from the drop-down menu to filter the auditor's search results. Exclude these addresses Enter a mailbox address that you want to hide from the specified account, and then click Add. 3. Admin Role Specify mailbox addresses that you want to hide from the specified account, and then click Add. 4. Click Save. Manually Add Local Accounts Click to manually add users... Local accounts reside only on the Barracuda Cloud Archiving Service. 1. Go to the Users > User Add/Update page, and enter the user's Address and the User Display Name. 2. Enter all aliases associated with the entered address, one entry per line. 3. Enter the account password and select the user role for the account. 4. If you select the user role Auditor enter the following additional details: Enter a domain for which the auditor can view messages and other Outlook items, and click Add. Any messages that includes an address in the listed domains in either the From, To, or CC/Bcc areas, or any items that belong to a user in the specified domains, display in search results. To allow the auditor to view all items from all domains, leave this field blank. In the Saved Search drop-down menu, select a defined Saved-Search to automatically apply to all 15 / 31

16 searches performed by this auditor. Note that the parameters in the Saved Search take precedence over any domain limitations that may be specified above, as well as over any attempts by the auditor to Search As any other account. Step 2. Add Domains You can also view the video for a short walk through of how to set up journaling to the Cloud Archiving Service from Office 365. Add domains and fully-qualified domain names (FQDNs) you want to archive. The FQDN consists of a host or system name and domain name, including the top-level domain. Any messages sent to any recipient in the listed domains are added to the archive. 1. Go to the Basic > Domain Management page, and enter the domain or FQDN in the LOCAL DOMAINS field. 2. Click Add, and then click Save. BARRACUDA CLOUD-TO-CLOUD BACKUP Office 365 Exchange Online Click here for Exchange Online setup details... See also: Cloud-to-Cloud Office 365 Exchange Online Configure an Exchange Online Data Source Use the following steps to set up Exchange Online backup: 1. Log in to Barracuda Backup, and select the Cloud Source in the left pane. 2. On the Status page, click Exchange Online: 3. The Data Sources page displays. Click Add a Cloud Provider, and enter the following details: 1. In the Cloud Provider description field, enter a name to represent the data source. 2. From the Cloud Provider type drop-down menu, select Microsoft Office Click Save. 4. The Add a Cloud Data Source dialog box displays: 1. From the Data Type drop-down menu, select Exchange Online: 16 / 31

17 2. Enter Your Office365 domain URL. To locate the native domain name associated with your Office 365 account, log in to the Office 365 portal using an administrative account, and go to Management > domains. The native domain is listed in the domains table ending with onmicrorsoft.com. 3. Click Authorize. If you are not currently logged into the Exchange Online account, the Microsoft login page displays. Enter your Exchange Online administrator login information, and then click Sign in. 5. In the Exchange Online page, click Accept to authorize Barracuda to back up data from Exchange Online: 6. The Edit Exchange Online page displays. 1. Enter a name to identify the data source in the Data Description field. 2. In the Add to schedule section, click the drop-down menu, and then click Add New: 17 / 31

18 7. The Add New Schedule dialog box displays: 8. Enter a name to represent the schedule, and click OK. The Edit Exchange Online page is updated with the new schedule name. 9. Click Save. The Edit Backup Schedule page displays. 10. In the Items to Back Up section, select individual items to back up, or click Apply to all computers and data sources for this Barracuda Backup Cloud Service to back up everything in Exchange Online. 11. In the Schedule Timeline section, select the day you want the schedule to run. 12. In the Daily Backup Timeline, specify the time of day the schedule is to run: 18 / 31

19 13. Click Save. Exchange Online is backed up based on your data source and schedule settings. Schedule an Exchange Online Backup Use the following steps to schedule an Office 365 backup: Log in to Barracuda Backup, and select the Cloud-to-Cloud Backup Source in the left pane. Go to Backup > Schedules. On the Schedules page, click Add a Schedule in the upper right-hand corner. Enter a name for your schedule in the Schedule name field: 5. In the Identify the data sources section, select the data to be backed up using this schedule. You can select Apply to all computers and data sources for this Barracuda Cloud to Cloud Backup or you can granularly select data down to a specific file or folder. 6. In the Schedule Timeline section, select the days you want the schedule to run. If you are creating a one-time only backup schedule, deselect all days: 19 / 31

20 7. In the Daily Backup Timeline section, enter a start time for your backup schedule. To repeat a backup schedule throughout a 24-hour period, select the Repeat option and specify the frequency of the backup and the end time. A backup schedule cannot span multiple days: 8. Once you have configured your backup schedule, click Save. 9. The backup schedule is now listed on the Schedules page and specifies the days and times that it is to run. To run a backup on-demand, click Run Backup Now, to edit the schedule click Edit, or to delete a schedule, click Remove: Office 365 OneDrive for Business Click here for OneDrive for Business setup details... See also: Cloud-to-Cloud Office 365 OneDrive for Business Configure a OneDrive for Business Data Source Use the following steps to set up OneDrive for Business backup: 1. Log in to Barracuda Backup, and select the Cloud-to-Cloud Backup Source in the left pane. 2. In the Status page, click OneDrive for Business: 3. The Data Sources page displays. Click Add a Cloud Provider, and enter the following details: 1. In the Cloud Provider description field, enter a name to represent the data source. 2. From the Cloud Provider Type drop-down menu, select Microsoft Office Click Save. 20 / 31

21 4. The Add a Cloud Data Source page displays: 1. From the Data Type drop-down menu, select OneDrive for Business. 2. In the Your OneDrive URL field, enter the first part of your OneDrive for Business URL; the URL is available once you log in to OneDrive for Business. Note that the portion is not required. For example, type: mydomain-my.sharepoint.com. 3. Click Authorize. 4. If you are not currently logged in to the OneDrive for Business account, the Microsoft login page displays: 5. Enter your OneDrive for Business administrator login information, and click Sign in. 5. The Edit OneDrive for Business page displays. 1. Enter a name to identify the data source in the Data Description field. 2. In the Add to schedule section, click the drop-down menu, and then click Add New: 21 / 31

22 6. The Add New Schedule dialog box displays. Enter a name to represent the schedule: 7. Click OK. The Edit OneDrive for Business page is updated with the new schedule name. 8. Click Save. The Edit Backup Schedule page displays. 9. In the Items to Back Up section: 1. Select individual items to back up, or 2. To back up everything on OneDrive, click Apply to all computers and data sources for this Barracuda Backup Cloud Service. 10. In the Schedule Timeline section, select the day you want the schedule to run. 11. In the Daily Backup Timeline, specify the time of day the schedule is to run: 22 / 31

23 12. Click Save. OneDrive is backed up based on your data source and schedule settings. Schedule a OneDrive for Business Backup Use the following steps to schedule an Office 365 backup: Log in to Barracuda Backup, and select the Cloud-to-Cloud Backup Source in the left pane. Go to Backup > Schedules. On the Schedules page, click Add a Schedule in the upper right-hand corner. Enter a name for your schedule in the Schedule name field: 5. In the Identify the data sources section, select the data to be backed up using this schedule. You can select Apply to all computers and data sources for this Barracuda Cloud to Cloud Backup or you can granularly select data down to a specific file or folder. 6. In the Schedule Timeline section, select the days you want the schedule to run. If you are creating a one-time only backup schedule, deselect all days: 23 / 31

24 7. In the Daily Backup Timeline section, enter a start time for your backup schedule. To repeat a backup schedule throughout a 24-hour period, select the Repeat option and specify the frequency of the backup and the end time. A backup schedule cannot span multiple days: 8. Once you have configured your backup schedule, click Save. 9. The backup schedule is now listed on the Schedules page and specifies the days and times that it is to run. To run a backup on-demand, click Run Backup Now, to edit the schedule click Edit, or to delete a schedule, click Remove: Office 365 SharePoint Online Click here for SharePoint Online setup details... See also: Cloud-to-Cloud Office 365 SharePoint Online Configure Site Collection Administration for SharePoint Online Data Sources In order for Barracuda Cloud-to-Cloud Backup to access SharePoint sites, you must create a primary site collection administrator. You must complete the following steps for each SharePoint Site Collection you want to back up. To configure the primary site collection administrator for SharePoint Online: 1. Log in to your Office 365 Management Panel using an account with administrative privileges, and go to the Office 365 admin center. 2. In the left pane click Admin centers > SharePoint. 24 / 31

25 3. Hover over and select the site collection you want to add the administrator to. 4. Click Owners > Manage Administrators: 5. The manage administrators page displays. In the Site Collection Administrators section, enter the name of the administrator you want to add as a Site Collection Administrator, and click the Check Names ( ) icon to verify the user name is valid. For example, SharePoint Service Administrator: 6. Click OK to save your changes and add the selected administrator as the Site Collection Administrator. Configure a SharePoint Online Data Source Use the following steps to set up SharePoint Online backup: 1. Log in to Barracuda Backup, and select the Cloud Source in the left pane. 2. In the Status page, click SharePoint Online: 25 / 31

26 3. The Data Sources page displays. Click Add a Cloud Provider, and enter the following details: 1. In the Cloud Provider description field, enter a name to represent the data source. 2. From the Cloud Provider type drop-down menu, select Microsoft Office Click Save. 4. The Add a Cloud Data Source dialog box displays: 1. From the Data Type drop-down menu, select SharePoint Online. 2. Enter Your SharePoint URL. The URL is available once you log in to SharePoint Online. 3. Click Authorize. If you are not currently logged in to the SharePoint Online account, the Microsoft login page displays. Enter your SharePoint Online administrator login information, and then click Sign in. 5. In the SharePoint Online page, click Accept to authorize Barracuda to back up data from SharePoint Online: 26 / 31

27 6. The Edit SharePoint Online page displays. Complete the following: 1. Enter a name to identify the data source in the Data Description field. 2. In the Add to schedule section, click the drop-down menu, and then click Add New: 7. The Add New Schedule dialog box displays. Enter a name to represent the schedule: 27 / 31

28 8. Click OK. The Edit SharePoint Online page is updated with the new schedule name. 9. Click Save. The Edit Backup Schedule page displays. 10. In the Items to Back Up section, select individual items to back up, or click Apply to all computers and data sources for this Barracuda Backup Cloud Service to back up everything in SharePoint Online. 11. In the Schedule Timeline section, select the day you want the schedule to run. 12. In the Daily Backup Timeline, specify the time of day the schedule is to run: 28 / 31

29 13. Click Save. SharePoint Online is backed up based on your data source and schedule settings. Schedule a OneDrive for Business Backup Use the following steps to schedule an Office 365 backup: Log in to Barracuda Backup, and select the Cloud-to-Cloud Backup Source in the left pane. Go to Backup > Schedules. On the Schedules page, click Add a Schedule in the upper right-hand corner. Enter a name for your schedule in the Schedule name field: 5. In the Identify the data sources section, select the data to be backed up using this schedule. You can select Apply to all computers and data sources for this Barracuda Cloud to Cloud Backup or you can granularly select data down to a specific file or folder. 6. In the Schedule Timeline section, select the days you want the schedule to run. If you are creating a one-time only backup schedule, deselect all days: 7. In the Daily Backup Timeline section, enter a start time for your backup schedule. To repeat a backup schedule throughout a 24-hour period, select the Repeat option and specify the frequency of the backup and the end time. A backup schedule cannot span multiple days: 8. Once you have configured your backup schedule, click Save. 9. The backup schedule is now listed on the Schedules page and specifies the days and times that it is to run. To run a backup on-demand, click Run Backup Now, to edit the schedule click Edit, or to delete a schedule, click Remove: 29 / 31

30 30 / 31

31 Figures 31 / 31