Office 365 for IT Pros

Transcription

1

2 Office 365 for IT Pros Fourth edition Migrating PST Files Using the Office 365 Import Service Published by Tony Redmond, Paul Cunningham, Michael Van Horenbeeck, and Ståle Hansen. Copyright by Tony Redmond, Paul Cunningham, Michael Van Horenbeeck, and Ståle Hansen. All rights reserved. No part of this book may be reproduced or transmitted in any form or by any means without the written permission of the authors. The example companies, organizations, products, domain names, addresses, logos, people, places and event depicted herein are fictitious. No association with any real company, organization, people, domain name, address, logo, person, place, or event is intended or should be inferred. The book expresses the views and opinions of the authors. The information presented in the book is provided without any express, statutory, or implied warranties. The authors cannot be held liable for any damages caused or alleged to be caused either directly or indirectly by this book. Although the authors are members of Microsoft s Most Valuable Professional (MVP) program, the content of this book solely represents their views and opinions about Office 365 and any other technologies mentioned in the text and is not endorsed in any way by Microsoft Corporation. Please be respectful of the rights of the authors and do not make copies of this ebook available to others. This information supplements the content presented Office 365 for IT Pros, available from

3 Contents Introduction... 4 Configuring the RBAC Permissions for the Office 365 Import Service... 4 Migrating PST Data with the Drive Shipping Method... 5 Migrating PST Data with the Network Transfer Method... 5 Uploading Unencrypted PST Files to Office Uploading Encrypted PST Files to Office Configuring Azure Rights Management... 8 Preparing to Encrypt PST Files... 9 Encrypting and Uploading PST Files... 9 Starting the Import Job Creating a Mapping File Starting the Import Process Monitoring the Import Process Completing the PST Migration... 13

4 Introduction With generous mailbox quotas and archiving features in Office 365, it makes sense to move data that has accumulated in user PSTs to Exchange Online mailboxes or archives, especially if you want to ensure that the data is available for compliance and ediscovery purposes. The Office 365 Import Service is available through the Data Migration section of the Office 365 admin portal Before using the Import Service, you must collect user PST files from user PCs or your network environment. Once the PSTs are ready, you can either upload them to Microsoft over the Internet or, if you have a large amount of data that makes a network transfer unfeasible, package the files on 3.5 inch SATA II/III drives (currently limited to 4 TB capacity) and ship the drives to a Microsoft datacenter. The mailboxes that are used as the target for PST imports can be an Exchange Online primary or archive mailbox, or an Inactive mailbox. You can test the Import Service process by importing a few PSTs to see how the process works and to satisfy yourself that the procedure is suitable for your tenant. Configuring the RBAC Permissions for the Office 365 Import Service Before creating a new import job, you first need to assign the Mailbox Import Export role to the Office 365 administrator account that you will be using for the task. You can either add the role to an existing management role group or create a new management role group that can then be assigned to the accounts responsible for processing import jobs. To create a new management role group, go to the Exchange Admin Center, navigate to Permissions, and select Admin Roles. Click on the plus icon to create a new role group. Give the new role group a meaningful name such as Mailbox Import Export, then click the plus icon below Roles. Figure 1: Creating a new management role group to control PST imports From the list of available roles choose Mailbox Import Export and click Add. Click OK, then click the plus icon below Members to add the user accounts that you wish to grant the mailbox import/export permissions to. When you have added all of the users that you need click Save to complete the task of creating the new

5 role group. The new permissions will take effect for the users the next time they log in to the Office 365 admin portal. Migrating PST Data with the Drive Shipping Method When you use the drive shipping method to transfer data to Microsoft, the data on the drives is protected by BitLocker encryption and includes a mapping file that associates each PST with a user account. Each drive is prepared using a special Azure Import/Export tool that creates a journal file for the drive containing the drive ID and the BitLocker key used to protect the data. When the drives arrive at Microsoft, they are loaded into Azure and made available to the tenant administrator. At this point, the tenant administrator can invoke an import job to start importing the data from the PSTs into the target mailboxes. The administrator who runs the job must possess the RBAC Mailbox Import-Export role and have access to the journal files. Once launched, the import job runs on Azure to process the PSTs found on the drive and uses the mapping file to move content from the PSTs into the target mailboxes. The mapping file can direct information to either primary or archive mailboxes. You can monitor progress of the import job from the Office 365 Admin console. Migrating PST Data with the Network Transfer Method If you have a high-capacity connection to the Internet and don't have a lot of PSTs to process, you can consider moving the PSTs over the network to a Microsoft datacenter instead. In this scenario, the data is still protected because: It is uploaded over HTTPS, so it is encrypted in transit It is uploaded to storage that is encrypted at rest, and you have the keys Once the data is uploaded, you can then run an import job to process the PSTs and transfer the content to user mailboxes. If you have a requirement for additional encryption of the individual PST files, you can use Azure Rights Management (Azure RMS) to encrypt the files before they are uploaded. This process follows a similar process as uploading unencrypted files, but uses the Office 365 Import Tool to perform the encryption and upload, instead of AzCopy which simply performs the upload, although AzCopy is still installed as part of this process. Uploading Unencrypted PST Files to Office 365 In the Office 365 admin portal select Users, then Data Migration from the left menu, and then choose Upload PST files. Click the plus icon to start a new import job (Figure 2). For this example, we re choosing to Upload messages (PST files). The option to ship data on physical hard drives might not appear if your Office 365 tenant is hosted in a datacenter that doesn't support that option yet.

6 Figure 2: Creating a new PST import job A wizard appears to guide you through the steps for creating the PST import job. If you haven t already done this, you need to download and install the Azure AzCopy tool from Microsoft. Install AzCopy on a workstation or server that has access to the location where the PST files have been collected. Next, click on Show network upload SAS URL to retrieve the secure storage account key (Figure 3). You should protect this key in a secure location as you would with any other administrative usernames and passwords for your environment. Figure 3: Accessing the network upload SAS URL Next we use the AzCopy tool to upload the PST files to Azure. In this example the PST files are stored on a shared folder on the network called \\MGMT\PST. The source path, destination (secure upload URL), and secure storage account key need to be provided as command line options for the AzCopy tool. The AzCopy tool can be run from CMD.exe. C:\>cd "Program Files (x86)\microsoft SDKs\Azure\Azcopy"

7 C:\Program Files (x86)\microsoft SDKs\Azure\Azcopy> azcopy.exe /source:\\mgmt\pst /dest:"secure_upload_url" /S /V:C:\Admin\PSTupload.log The network upload URL must be placed in quotes or you will receive an error message. Some additional command line parameters are also used in this example: /S tells AzCopy to also upload files in subfolders of the source directory /V specifies the file to output logging information to A full list of AzCopy command line options is available from Microsoft. Warning: You may be tempted to enter the command line into a batch file to make it easier to run. However, if you do then you must keep the batch file secure, as it contains the highly sensitive secure upload URL and storage key for Azure that will be used for the PST file uploads. AzCopy runs as an interactive process, not a background service. You will need to keep the CMD window open and running while the PST files are uploaded. However, you do not need to keep the web browser window open that provides you with your storage key and secure upload URL. Those can be retrieved again at any time in the Import section of the Office 365 admin center by clicking on the key icon (Figure 4). Figure 4: Accessing secure information for the import job Naturally the amount of time it takes to upload all of the PST files will largely depend on the speed of your network connection to the internet. While AzCopy is running it stores two journal files in the %appdata%\local\microsoft\azure\azcopy folder so that it can detect whether a transfer succeeded or failed. If you encounter timeout errors, you can simply run the command again and any incomplete transfers will resume. Real World: AzCopy uses default parameters that are optimized for high bandwidth network connections. If you re attempting to upload PST files over a low bandwidth connection, you may see the operation repeatedly failing due to time out errors. If that occurs, you can reduce the number of concurrent operations to avoid overloading the network. When the file upload is complete you ll see a summary confirming the number of successful, skipped, or failed file transfers. Finished 3 of total 3 file(s). [2016/05/09 17:03:55] Transfer summary: Total files transferred: 3 Transfer successfully: 3 Transfer skipped: 0 Transfer failed: 0 Elapsed time: 00.00:52:13 Uploading Encrypted PST Files to Office 365 For organizations that require additional encryption of the individual PST files before they are uploaded, it is possible to use Azure RMS to achieve that goal. Azure RMS is not available in all Office 365 subscriptions, so you should first verify that you re eligible to use the service.

8 Configuring Azure Rights Management Even if your Office 365 tenant is eligible for Azure RMS, you might still need to enable it for use because it is not enable by default. To enable Azure RMS, you ll need both the Azure Active Directory Module for PowerShell and the Azure Rights Management Administration Tool installed. Install both tools on the computer or server where you ll be encrypting and uploading the PST files. Open PowerShell and connect to the Azure RMS. Login with your Office 365 global administrator credentials. PS C:\> Connect-AadrmService Run the Get-Aadrm cmdlet to check the current status of your Azure RMS configuration, and enable it if necessary. PS C:\> Get-Aadrm Disabled PS C:\> Enable-Aadrm The Rights Management service has been successfully enabled although additional configuration of other services might be required. For more information, see Next, connect to Exchange Online. Refer to the PowerShell tips in chapter 5 to learn how to do this. After connecting to Exchange Online with PowerShell, configure Information Rights Management (IRM) to use Azure RMS. The RMS key sharing location URL will depend on the location of your organization. Microsoft has URLs available for different regions: North America - European Union - Asia - South America - Office 365 for Government - PS C:\> Set-IRMConfiguration -RMSOnlineKeySharingLocation " As the last part of the Azure RMS configuration, import a Trusted Publisher Domain (TPD) from RMS Online to your Office 365 tenant. Trusted publishing domains allow servers to issue use licenses that correspond with a publishing license issued by a different server. In other words, it permits two RMS servers to work together so that RMS protected content can be sent between organizations, in this case between your organization and Microsoft. Then finally, enable IRM for your Office 365 organization. PS C:\> Import-RMSTrustedPublishingDomain -RMSOnline -Name "RMS Online" Name : RMS Online - 1 CryptoMode : 2 KeyId : {8f77cdf2-4b52-4d92-908d-1d23c05f0c44} IntranetLicensingUrl : ExtranetLicensingUrl : Default : True AddedTemplates : {Exchange Server Pro - Confidential, Exchange Server Pro - Confidential View Only} UpdatedTemplates : {} RemovedTemplates : {} PS C:\> Set-IRMConfiguration -InternalLicensingEnabled $true

9 Preparing to Encrypt PST Files On the computer or server where you ll be encrypting and uploading the PST files, install the Rights Management Service Client. Open PowerShell and connect to Office 365. PS C:\> Connect-MsolService Generate a new encryption key that will be used for encrypting the PST files. This is a symmetric key, meaning it can be used for both encryption and decryption. You should protect this key as you would any other password. When you run the New-MsolServicePrincipal command shown below, the key will be output to your PowerShell console. PS C:\> New-MsolServicePrincipal -DisplayName PstEncryptionPrincipal The ouput from the command above will also include an application identifier, displayed as the AppPrincipalId attribute. You will also need to save that value for use later in this process. If you neglected to save the information you can retrieve it later by running the following command. PS C:\> Get-MsolServicePrincipal Where {$_.DisplayName -eq PstEncryptionPrincipal } Connect to the Azure RMS again, and run the following commands to retrieve the BPOSId and the LicensingIntranetDistributionPointUrl values. You ll need these values in an upcoming step as well. PS C:\> Connect-AadrmService PS C:\> Get-AadrmConfiguration Select BPOSId BPOSId b9bca49-687e-4e5f-8a b719b06 PS C:\> Get-AadrmConfiguration Select LicensingIntranetDistributionPointUrl LicensingIntranetDistributionPointUrl Encrypting and Uploading PST Files Encrypted PST file uploads start in much the same way as the unencrypted method. Log in to the Office 365 admin center and navigate to Users, Data migration, and then choose Upload messages (PST files). Figure 5: Starting a new upload

10 A wizard appears to guide you through the steps for creating the PST import job. If you haven t already done this, you need to download and install the Azure AzCopy tool from Microsoft. Install AzCopy on a workstation or server that has access to the location where the PST files have been collected. AzCopy is used for uploading encrypted PST uploads, but first the files need to be encrypted by the Office 365 Data Encryption and Import Tool. At the time of this writing Microsoft s own documentation describes how to encrypt and upload the files using a single tool called O365ImportTool.exe. However, that tool is not available as a download. Instead, the O365Protect.exe tool is made available. Microsoft has not added a link to the tool in the new admin center, but you can access it here. You ll need to be logged into the portal in your web browser for that link to work. There s no installation required for the encryption tool, just download the zip file and extract the O365Protect.exe file to a folder on the computer where AzCopy is installed, and that you ll be uploading the PST files from. Next, click on Show network upload SAS URL to retrieve the secure storage account key (Figure 6). You should protect this URL in a secure location as you would with any other administrative usernames and passwords for your environment. Figure 6: Accessing the network upload URL The syntax for O365Protect.exe is as follows: C:\Admin> O365Protect.exe /sourcefolder:<source folder> /sourcepattern:"*.pst" /rmsserver:<rms URL> /tenantid:<bpos Id> /ownerid:<owner Id> /key:<symmetric Key> Use the following values for your environment: Source folder the folder containing the PST files to be encrypted. This can be the UNC path to a file share, or a local path. You must have access to modify files in this location. Source pattern Use *.pst to encrypt all PST files in the source folder. If PST files are stored in sub-folders use the /recurse switch as well. RMS server use the LicensingIntranetDistributionPointUrl value you retrieved earlier. Tenant Id use the BPOSId value you retrieved earlier. Owner Id use the AppPrincipalId value you retrieved earlier for the MsolServicePrincipal.

11 Key use the symmetric key value you generated earlier when you ran New-MsolServicePrincipal. Wrap each of the parameter values in quotes when you construct your own command line. When you re ready, run the O365Protect.exe command line you ve constructed, and watch the output to determine whether encryption was successful or not. Encrypting \\mgmt\pstimport\import Demo 1.pst 100% Elapsed Time: 00:00: Encrypting \\mgmt\pstimport\import Demo 2.pst 100% Elapsed Time: 00:00: Encrypting \\mgmt\pstimport\import Demo 3.pst 100% Elapsed Time: 00:00: Total Elapsed Time: 00:00: After the encryption process has finished you can use AzCopy to upload the PST files following same steps outlined earlier in this guide when demonstrating the upload of unencrypted files. Starting the Import Job Uploaded PST files are retained for 30 days, allowing you time to perform multiple uploads before you begin the import process itself. Once you are happy that you ve uploaded all the PST files that you want to import, you can provide the Import Service with a mapping file and then commence the import process itself. Creating a Mapping File After the PST file has been upload the next step is to create a CSV file that maps each uploaded file to an Office 365 user. Microsoft provides a sample PST mapping file that you can download and use to ensure that you have the correct data entered. Each line of the CSV file maps one PST file to one mailbox (Figure 7). If you have multiple PST files for a mailbox then you will need to use multiple lines in the CSV file, one for each PST file. The file path format needs to be changed by removing leading backslashes, and replacing all other backslashes with forward slashes. For example, if a PST file was in the root of the path \\MGMT\PST then the file path in the CSV should be left blank, whereas if the file was in \\MGMT\PST\Server01, then the file path in the CSV file should be /Server01. The IsArchive field is used to specify whether the PST file data is imported into the primary mailbox or the archive mailbox. If you are importing to the archive mailbox the mailbox user must be archive-enabled first, because the Import service will not automatically archive-enable mailboxes for you. An IsArchive value of FALSE will import into the primary mailbox. Whether you re importing to the primary mailbox, or to an archive mailbox, you can use the TargetRootFolder field to specify a folder to import the data to. Figure 7: A PST mapping file Starting the Import Process Return to the Office 365 admin center. If you had already closed the browser window, simply click the plus icon again to create a new import job. This time we ve already completed the upload of PST files and

12 prepared the mapping file, so we can tick the two confirmation boxes and then click Next to continue to the next steperror! Reference source not found.. Enter a simple name for the import job when prompted, taking care to comply with the specific naming standards for import jobs, and click Next to continue. Now you can upload the mapping file that was created earlier. Click the + icon and navigate to the CSV file that contains the mapping information (Figure 8). CSV files of less than 100 rows need to be validated first, and if anything causes the validation to fail, you can click on the link in the Status column to download a validation report that will explain why it failed. When the file has finished uploading and has been validated, tick the box to agree to the terms and conditions of the import service. Finally, when everything is ready, click the Finish button to finish creating the import job. Figure 8: Uploading mapping files Monitoring the Import Process After the import job begins, from the Import Service area of the Office 365 admin center you can click the View details link to view the progress of the data import and see any errors that have occurred. The most likely error you ll run into is a PST file that either hasn t been uploaded or can t be found by the import job because the path you specified CSV file is not correct. The PST file names and paths are also case sensitive so you should take care to use the correct case in the CSV file when you create it. As the import proceeds and information is loaded into user mailboxes, the owners of the mailboxes will see the imported data appear in the root folder that you specified in the CSV mapping file (Figure 9).

13 Figure 9: Newly imported information shows up in a user mailbox Real World: Importing PST data into Office 365 is only part of the process. Naturally you need to find the PST files first, using tools such as Microsoft Exchange PST Capture Tool. You ll also need to disconnect any Outlook profiles from the PST files, work out who owns each PST file that you find, and prevent creation of new PST files by users in your environment. Completing the PST Migration After you ve completed the importing of PST files into Exchange Online you may wish to take additional steps to eliminate the use of PST files within your network. Microsoft provides no specific tools for disconnecting PST files from Outlook profiles, however you can use Group Policy to prevent users from adding any more data to their PST files, and to prevent them from creating new PST files. The Group Policy administrative templates for Outlook 2007 and later include options under Miscellaneous/PST Settings that can be used to: Prevent users from adding more items to an existing PST file Prevent users from connecting any more PST files to their Outlook profiles

14 Figure 10: Group Policy options to control PST files If you have multiple versions of Outlook in your environment, you ll need to configure Group Policies that use the administrative templates for each specific version.