The connector for Office 365 supports account provisioning only for users in Active Directory, eDirectory, and JDBC identity sources. For more information, see Section 2.4.1, Requirements for Provisioning.
Complete the following steps before you install the connector for Office 365:
Identify an existing Office 365 administrative account to use, or create a new administrative account. This administrative user must not belong to the Office 365 domain that CloudAccess will manage.
Identify the verified Office 365 domain for which CloudAccess will manage authentication.
Microsoft does not support subdomains having different federated settings than their parent. To use a subdomain for Office 365, ensure that either you do not use Office 365 with the parent domain, or that both the parent domain and its subdomain have the identical federation settings.
Identify a Windows Management Server on which to install the connector. The connector does not need to be installed on a domain controller or even need to be part of the domain where the CloudAccess appliance is installed. The Windows server can be a standalone server, as long as it meets the following requirements:
Windows Server 2012 R2 or Windows Server 2008 R2 operating system with all available updates installed.
Microsoft IIS 7 with the Web Server (IIS) role enabled and the ASP.NET 4.x feature added. The connector uses HTTPS between the CloudAccess appliance and the Office 365 web application in IIS.
Microsoft .NET Framework 4.x. You can download .NET from the .NET downloads web page.
Microsoft Online Services Sign-In Assistant 7.x. You can download the Microsoft Online Services Sign-In Assistant software from the following location: Microsoft Online Services Sign-In Assistant for IT Professionals BETA. Select the msoidcli_64.msi file.
Windows Azure AD Module for Windows Powershell. You can download the module from the following location: Manage Windows Azure AD using Windows PowerShell.
The Microsoft Lync support is available only if you configure the connector with WS-Federation.
(Conditional) If you plan to use the Enhanced Client Profile (ECP), also called HTTP proxy authentication, in Microsoft Outlook, or if you plan to use Microsoft Lync, ensure that you configure CloudAccess with the following:
A publicly resolvable, publicly accessible IP address. You can use port forwarding to protect your appliance behind your corporate firewall.
When the user logs in to the Office 365 online portal, the browser handles all of the redirects and name resolution, so you can manually edit entries in the device’s ../etc/hosts files to work around name resolution. However, with ECP and Lync, Office 365 actually sends an authentication request directly to CloudAccess, so its IP address must be publicly accessible.
An SSL certificate signed by a trusted certificate authority (CA) such as Verisign, Thawte, Symantec, Digicert, and so on. The certificate common name must match the appliance hostname.
NOTE:CloudAccess also supports ECP for Microsoft Exchange email on mobile devices running Android or iOS. The users must add an Exchange account on their device and enter their Exchange credentials. For more information, see the following Microsoft web pages:
If you use WS-Federation for the connector for Office 365, CloudAccess also supports ECP for Microsoft Lync. The users must add a Lync account on their mobile device and enter their Lync credentials. For more information, see the following Microsoft web pages: