Essentials Wizard Help - Configure Office 365

Transcription

1 For a list of Essentials options and setup instructions, see Step 1 - Set Up Essentials for Office 36 PowerShell Requirements The Essentials Wizard utilizes PowerShell scripts to quickly configure and set up your services. Windows 8 or 8.1 Windows Server 2012 or Windows Server 2012 R2 Windows 7 Service Pack 1 (SP1)* Windows Server 2008 R2 SP1* Microsoft.NET Framework 4.5 or 4.1 and either the Windows Management Framework 3.0 or the Windows Management Framework 4.0 Verify the service account has a mailbox and is not hidden in the Global Address list PowerShell credentials Run or Download PowerShell Script You can select to automatically configure permissions, download and run the PowerShell scripts, or manually configure permissions without using the PowerShell scripts. Select from the configuration options: Allow Barracuda to configure connectors and permissions (recommended) Select this option to allow Barracuda to run a PowerShell script to automatically configure connectors and permissions. Download and Run the Windows PowerShell Script Select this option to download or copy the PowerShell script to your local system and manually run the PowerShell script on the Windows Server from Windows PowerShell. Manually configure connectors and permissions Select to exit the wizard and manually configure the selected services. Option 1. Allow Barracuda to configure connectors and permissions (recommended) 1. Select Allow Barracuda to configure connectors and permissions (recommended), and click Continue. When prompted, enter your Office 365 credentials, and click OK. Multi-factor authentication (MFA), also known as two-factor authentication, is a security feature that requires two forms of authentication to access Barracuda Cloud Control. When enabled, MFA provides an extra layer of security to your account. For more information, see Understanding Multi-Factor Authentication in Barracuda Cloud Control. 1 / 11

2 3. Once configuration is complete and your Office 365 account authorizes the connection, the Configuration Summary displays. Click OK. Option Download and Run the Windows PowerShell Script Before running the PowerShell script, verify the wizard has completed successfully. Step 1. Download Microsoft Tools 1. Download and install the SharePoint Online Management Shell from the Microsoft Windows Download Center Download and install the Microsoft Online Services Sign-In Assistant from the Microsoft Windows Download Center Step Run the PowerShell Script 1. Log in to the Windows Server, and open Windows PowerShell. Run the PowerShell script: Click Download PowerShell Script to download the script to your local system, or Click View PowerShell Script to display and copy the script 3. When prompted, enter the Office 365 global admin credentials used on the Link Office 365 page in the Wizard. 4. If the wizard is unable to connect to your Office 365 account, click Retry connection. Once authorized, click Finish. If you encounter errors when running the PowerShell script, contact Barracuda Networks Technical Support. Once the PowerShell script runs, the following settings are added to your Barracuda Essentials for Office 365 account: Outbound routing is set up through Barracuda Security Service Journaling is set up through Barracuda Cloud Archiving Service (if you selected Security and Compliance or Complete Protection and Compliance) User impersonation for Exchange Online and all OneDrive for Business sites is configured Step 3. Complete Your Essentials Setup Option 3. Manually You can manually set up your services using the web interface. When selected, the Essentials page in Barracuda Cloud Control displays. Barracuda Security Service Click here to configure Barracuda Security Service... Step 1. Ensure Connectivity and Redundancy 2 / 11

3 Open your firewall ports to allow the IP address range /20 for LDAP Connectivity (Optional) Restrict Inbound Mail to the Barracuda Security Service IP Range Step Configure Domains In Barracuda Cloud Control, click the Barracuda Security Service icon, click Domains, and click Add Domain. In the dialog box, enter the primary Office 365 Domain Name you want to filter, for example: corpdomain.com Enter the Mail Server hostname (FQDN) or IP address for the domain entered in the previous step, for example: corpdomain-com.mail.protection.outlook.com Click Add. 6. Click Verify in the Mail Servers column; the Domains > Domain settings page displays. Select the manner in which to verify the domain ownership: MX Records Replace your current MX records with the Barracuda Security Service MX records displayed on the verify page. CNAME Records Validate your domain by adding a CNAME record. to the domain's technical contact Send a verification to the technical contact address listed on your domain's WHOIS entry. to the postmaster Send a verification to the postmaster address for your domain. The confirmation will include a link that the recipient can click to verify the domain. On the Domains page, click Edit in the Settings column; the DOMAINS > Domain Settings page displays where you can complete the configuration. Barracuda Cloud Archiving Service Click here to configure the Barracuda Cloud Archiving Service... Barracuda Cloud-to-Cloud Backup Click here to configure the Barracuda Cloud-to-Cloud Backup... Office 365 OneDrive for Business: Configure Impersonation Click here to configure OneDrive for Business... In order for Barracuda Cloud-to-Cloud Backup to access OneDrive user accounts for backup, you must create a new service account with administrative privileges, and then assign that account SharePoint Site Collection Administrator privileges. Step 1. Create a New Service Account 1. Log in to your Office 365 Management Panel using an account with administrative privileges, and click users and groups in the left pane. click the + symbol to create a new account. 3. In the details page, enter the details for the new service account, and click next. 3 / 11

4 4. In the settings page, select Yes to assign administrator permissions, and from the drop-down menu, select Global administrator. Optionally, you can add an alternate address and location. Click next. In the assign licenses page, make no changes. Click next. 6. In the send results in page, click Create. The service account details are sent to the admin. 7. To activate the account, log in to your Office 365 Management Panel using the new service account, and update the password. Step Configure Permissions Use this step to configure permissions for current users. There are two options you can use to give the service account created in Step 1. Create a New Service Account access to user accounts: Option 1 Run a SharePoint Online Management Shell script to automatically apply the proper permissions to each user account; this is the preferred and fastest. If you have multiple users, this is also the easiest method. or Option 2 Manually configure each user account from within the Microsoft SharePoint Admin Center. If you have only a few users, this is the easiest method. Option 1. Configure Permissions Using a SharePoint Online Management Shell Script 1. Download and open the AdminRights.ps1 script using a text editor such as Notepad. Navigate to and edit the following four variables: $o365login Replace with your Office 365 service account or administrator account username. $o365pw Replace with your Office 365 service account or administrator account password. $spadminurl Replace with the same URL used in your organization's OneDrive URL, but suffixed with -admin $spmyurl Replace with the same URL used in your organizations OneDrive URL, but suffixed with -my Save and close the script. Locate the SharePoint Online Management Shell installed in Step 1, then right-click and click Run as administrator. Change your working directory within the SharePoint Online Management Shell to the location where you saved the AdminRights.ps1 script: 6. Run the following command: Set-ExecutionPolicy Unrestricted 7. Run the following command to run the AdminRights.ps1 script:.\adminrights.ps1 4 / 11

5 8. 9. Press Enter to exit the script. Exit SharePoint Online Management Shell. You must complete the steps in Option 1 each time you add new users. Option Configure Permissions from the Microsoft SharePoint Admin Center 1. Log in to your Office 365 Management Panel using the service account created in Step 1. Create a New Service Account. In the left pane click Admin centers > SharePoint, and click user profiles. 3. Click Manage User Profiles: 5 / 11

6 4. In the Find profiles field, type the name of a user who's OneDrive for Business data is to be backed up, and then click Find: Click the user's Account name, and then click Manage site collection owners: 6. The site collection owners dialog box displays. In the Site Collection Administrators field, add the service account with administrative privileges or another account with administrative privileges: Type the account name, and then click the Verify User ( ) icon, or Click the Directory ( ) icon, and navigate to and select the account from the directory: Click OK. The service account or administrative account added as the user's Site Collection Administrator can now view the user's entire OneDrive account. Repeat Steps 3 through 7 for each user who's OneDrive for Business data is to be backed up with Barracuda Cloud-to-Cloud Backup. Step 3. Set Up Impersonation Permissions Use these steps when adding all future users. 6 / 11

7 Complete the following steps to set up impersonation permission for the service account on all newly created OneDrive users: Log in to your Office 365 Management Panel using the service account created in Step 1. Create a New Service Account. In the left pane click Admin centers > SharePoint, and click user profiles. In the My Site Settings section, Click Setup My Sites. In the My Site Secondary Admin section, click Enable My Site secondary admin. In the Secondary admin field, type the username of the newly created service account. Click OK. Office 365 Exchange Online: Configure Impersonation Click here to configure Exchange Online... In order for Barracuda Cloud-to-Cloud Backup to access user mailboxes for backup, you must create a new service account with administrative privileges and apply the impersonation role to that account. To configure impersonation within Exchange Online: Step 1. Create a New Service Account 1. Log in to your Office 365 Management Panel using an account with administrative privileges, and click users and groups in the left pane. Click the + symbol to create a new account. 3. In the details page, enter the details for the new service account, and click next. 4. In the settings page, select Yes to assign administrator permissions, and from the drop-down menu, select Global administrator. Optionally, you can add an alternate address and location. Click next. In the assign licenses page, make no changes. Click next. 6. In the send results in page, click Create. The service account details are sent to the admin. 7. To activate the account, log in to your Office 365 Management Panel using the new service account, and update the password. Step Create Impersonation Role Option 1. Manually Set Up Impersonation Click here to see more 1. Log in to your Office 365 Management Panel using an account with administrative privileges, and go to permissions > admin roles. Click the + symbol. In the new role group dialog box, type BarracudaBackupImpersonation in both the Name and Description fields: 7 / 11

8 3. Scroll down to Roles, and click the + symbol. 4. From the list, select ApplicationImpersonation, and click add: 8 / 11

9 6. 7. Click OK. Scroll down to Members, select the service account created in Step 1: Create a New Service Account, and click add. Click OK. Click Save to save your settings and close the Role Group window. The Impersonation role is now listed in Admin Roles. Option Set Up Impersonation via PowerShell Click here to see more Use the following steps to assign the ApplicationImpersonation role using PowerShell: 1. At the PowerShell command prompt, enter the following command: New-ManagementRoleAssignment name:impersonationassignmentname Role:ApplicationImpersonation User:serviceAccount Where: name is the friendly name of the role assignment. Each time you assign a role, an entry is made in the role-based access control (RBAC) roles list. You can verify role assignments by using the cmdlet Get- ManagementRoleAssignment found in the Microsoft Dev Center article How to: Configure impersonation. Role is the RBAC role to assign. When you set up impersonation, you assign the ApplicationImpersonation role. User is the service account. Press Enter. Actions Click Cancel Setup to exit the wizard and return to the Barracuda Essentials page, or click Back to return to the previous page in the wizard. 9 / 11

10 / 11

11 Figures 11 / 11