Diese Seite auf Deutsch anzeigen?

First Setup: Customer with on-prem Exchange

Introduction

This implementation guide covers the first setup of MailStore Cloud for customers that are using their own on-premises Exchange Server as their directory service. The guide includes many links to help pages that provide more detailed information about various topics.

It is assumed that you received your registration information including username, password and the login URL via mail. If you did not receive this information, please contact the MailStore support.

Prerequisites

Make sure your exchange server is accessible by MailStore Cloud (e.g. Firewall rules).

Login

As a first step, please use the credentials that were provided to you to login to the administrative web access (short “Admin Access”). Please make sure that the URL ends on “/adminaccess”. You will notice that your username looks like a mail address, consisting of a name and a domain. The domain is used to identify you as a customer within MailStore Cloud. It cannot be used outside of MailStore Cloud, i.e. you cannot send mails to it or use the domain in your browser. In the screenshot below, you can see the username for a customer with customer name “democustomer”.

Admin Access at a Glance

After you have successfully logged in, you will see the dashboard of the Admin Access. It presents you with basic information about your tenant and points out inconsistencies in your configuration. You should check the dashboard from time to time to make sure everything is working smoothly.

The main menu of the Admin Access on the left provides access to both configurations and the process log. During this first setup, only a few of the sections of the Admin Access will be needed.

Create a Secret

To create a secret:

  1. In the AdminAccess, navigate to the Secrets tab in the Compliance section.
  2. Enter a meaningful description in the Description text field.
  3. Select Basic Credentials in the Type dropdown menu.
  4. Enter a username and password of a user who has access to the directory service.
    Note: The username must be in UPN notation, e.g. [email protected]
  5. Click Save.

 

Create Directory Service Configuration

To create a Directory Service Configuration:

  1. In AdminAccess, navigate to Directory Services and select Add directory service.
  2. Enter a name in the Name text field.
  3. In the Type dropdown, select Active Directory.
  4. Enter your server’s address, e.g exchange.your-domain.com
  5. Select the domain the users/groups should be added to inside MailStore Cloud.
    Note: The default domain provided by MailStore can be used. A new one can also be created in the Domains section in User Management.
    Usernames in MailStore Cloud will be of the format <name in exchange>@<domain>.
  6. Check if any deleted users/groups from the exchange server should also be deleted in MailStore Cloud.
  7. Select the Credentials that were created in the first step.
  8. When all mandatory properties are filled you can click on the Test Connection button to test the given configuration. A new dialog will open and show the result of the connection test.
  9. Click Save

Create a Schedule to run the Directory Service Synchronization

To create a Schedule to run the Directory Service Synchronization:

  1. In the Directory Service list, click the clock icon on the previously created directory service configuration.
  2. Select the recurrence. The directory service synchronization should be executed periodically, e.g. once every day.
  3. Click Save.

The schedule should now be executed at your selected timeframe. You can find a log for the execution under Process Log in the Compliance section. A schedule can also be created or edited in the Schedules section in the Archiving section.

The directory service synchronization will synchronize the following data:

  • MailBoxes
  • Users
  • Groups

Configure a group to grant access to WebAccess

To enable the users to have access to their archive, the Reader role needs to be added to the user through a group permission.

To configure a group to grant access to WebAccess:

  1. In Admin Access, navigate to Groups.
  2. Select a group containing all users who need access to WebAccess. If one does not exist, create a new group, and add those users.
  3. Edit the group’s permissions by selecting the wrench icon.
  4. Select the Reader role for the user group.
  5. Click Save.

After adding the Reader role it should be possible for the synchronized users to log into WebAccess.

 

Adding the “Admin” role to a synchronized user

The Admin role should also be added to one of the synchronized users to gain access to AdminAccess.

To add the Admin role to a user:

  1. Navigate to the Groups section in AdminAccess.
  2. Select a group containing the users who need access to AdminAccess. If one does not exist, create a new group, and add those users.
  3. Edit the group’s permissions by selecting the wrench icon.
  4. Select the Admin role.
  5. Click Save.

You could now log out and log in again with one of the synchronized admin users. The provisioned (not synchronized) admin can be deleted.

 

Setup Journaling

The two types of journaling available in Microsoft Exchange 2019 are standard and premium journaling:

  • Standard journaling is configured on the mailbox database level, and records all sent and received emails of that database.
  • Premium journaling allows to limit journaling to particular recipients or distribution lists through rules; furthermore, internal and external emails can be treated differently. Additionally, premium journaling rules are replicated throughout the whole Exchange organization.

Method 1: Standard Mailbox Journaling

Log on to the Exchange admin center of your Microsoft Exchange environment as an Exchange administrator.

  1. Choose the recipients menu item.
  2. In the mailboxes section, click on + (New) and select User Mailbox.
  3. Enter a valid Alias (e.g. journal).
  4. Select the option New user. Enter the necessary data to create a new user.
  5. Click More options…
  6. Select Browse to select a mailbox database.
  7. Click Save. The new user and corresponding mailbox are created.

In MailStore Cloud you need to re-run the Directory Service Synchronization to add the new created user and mailbox. To do this:

  1. Navigate to the Exchange admin center of your Microsoft Exchange environment.
  2. Select the Serversmenu item.
  3. On the Databases tab, double click on the mailbox database for which you want to set up journaling.
  4. Select the Maintenance tab.
  5. Click on browse…
  6. Select the user that was created from the recipient list and confirm by clicking OK.
  7. Click save to confirm the changes.

In MailStore Cloud, create a secret to login to the journal mailbox:

  1. Navigate to the Secrets section.
  2. Click Add secret.
  3. Enter a name in the Description text box.
  4. In the Type dropdown menu, select Basic Credentials.
  5. Enter username and password of the user created for the journaling in prior steps.

In MailStore Cloud, create an archiving profile:

  1. Navigate to Archiving Profiles.
  2. Click Add archiving profile.
  3. Enter a name in the Name text field.
  4. In the Type dropdown menu, select Exchange Server
  5. For mode, select Single mailbox.
  6. Select the mailbox previously created for journaling.
  7. Enter the exchange server’s hostname.
  8. Select the Credentials created in the previous step.
  9. The timeout can be left empty to use the default.
  10. When all mandatory properties are filled you can click on the Test Connection button to test the given configuration. A new dialog will open and show the result of the connection test.
  11. Click Save.
  12. In the Archiving Profiles list, click the clock icon on the previously created archiving configuration.
  13. Select the recurrence: Archiving the Journal Mailbox should run periodically.
  14. Click Save.

Method 2: Exchange 2019 Premium (Push) Journaling

Premium Journaling is used to push emails from the mailing system (in this case Exchange Server) directly into the archive

Notice: Premium journaling requires Exchange Enterprise CALs.

Create a Journaling Endpoint in MailStore Cloud

  1. AdminAccess -> Journal Endpoints -> Add journal endpoint
  2. Give a name
  3. Select a journaling mailbox. You should create a new mailbox in MailStore cloud only used for journaling. You can create a new mailbox directly from the “Select Mailbox” dialog by clicking on the + button.

Click on “Save”. After save the dialog will stay open and show a “SMTP Address” entry which can be copied: This will be used in the next step.

Configure Journaling in Exchange 2019

  1. Log on to the Exchange admin center of your Microsoft Exchange environment.
  2. Select the compliance management menu item.
  3. On the journal rules tab, click on + (New).
  4. Enter a name for the journal rule, e.g. MailStore Journaling
  5. In the If the message is sent to or received from… section select whether the rule should apply to all messages or to specific users or groups.
  6. Under Journal the following messages…, choose whether to capture all messages, internally sent messages only, or only those messages with an external sender or recipient.
  7. Paste the “SMTP Address” value copied from the AdminAccess into the “Send journal reports to” field
  8. Click on save to activate the rule.

Please keep in mind that in complex Microsoft Exchange environments it may take several minutes until the new rule becomes effective.

Create an Archiving Profile

Mailbox Archiving should run once to archive all mails already existing. Future mails will be archived through Journaling.

To create an Archiving Profile:

  1. In AdminAccess, navigate to Archiving Profiles.
  2. Enter a name in the Name text field.
  3. In the Type dropdown menu, select Exchange Server.
  4. Select the Multiple mailboxes for Mode.
  5. Select the directory service from the previous step “Create a Directory Service Configuration”.
  6. Enter the Exchange server’s hostname.
  7. Select the Credentials created in the first step if that user is an impersonation user, otherwise create new credentials for an impersonation user.
  8. The timeout can be left empty to use the default setting.
  9. Click Save.

Create a Schedule to run the Archiving Profile

To create a schedule:

  1. In the Archiving Profiles list, click the clock icon on the previously created archiving configuration.
  2. Select the recurrence ‘As we use Journaling the archiving must only be executed once’.
    A schedule with recurrence “Once” must always be timed at least 1 minute in the future for it to be executed.
  3. Select Save.

The schedule should now be executed at your selected timeframe, you can find a log for the execution under Process Log in the Compliance section. A schedule can also be created or edited in the Schedules section.

Once the archiving schedule is successfully completed, the schedule and archiving configuration can be deleted.

Create a Folder Synchronization configuration

To create a Folder Synchronization configuration:

  1. Navigate to Folder Synchronizations in the AdminAccess.
  2. Select Add folder synchronization.
  3. Enter a name in the Name text field.
  4. In the Type dropdown menu, select Exchange Server.
  5. Select Multiple Mailboxes.
  6. Select the directory service from the previous step “Create a Directory Service Configuration”.
  7. Select if you want to delete emails from the source mailbox once they have been archived and the foldersync ran successfully. The default option is “Never delete”.
    You can also choose to run a directory service synchronization before the folder synchronization to refresh the users and groups. With that option you do not need a separate schedule for the directory service synchronization. The default for that option is “false”.
  8. Enter the exchange server’s hostname.
  9. Select the Credentials you used during creation of the archiving profile, i.e. credentials of an impersonation user.
  10. The timeout can be left empty to use the default setting.
  11. Click Save.

Create a Schedule to run the Folder Synchronization

To create a Schedule:

  1. In the Folder Synchronizations list, click the clock icon on the previously created folder synchronization configuration.
  2. Select the recurrence. The folder synchronization should be executed periodically, e.g. once every day.
  3. Click Save.

 

The schedule should now be executed at your selected timeframe, you can find a log for the execution under Process Log in the Compliance section. A schedule can also be created or edited the Schedules section.

Log in to WebAccess

You should now be able to log in to WebAccess with any of your synchronized users.

Compliance

You could now continue by setting up compliance rules for your archive.