Firewall Configuration for Office 365

Microsoft has 2 technet articles that may be of use when Configuring Office 365 to connect through a firewall.

The First, Office 365 URLs and IP address ranges Lists all the IP ranges and URL's Office 365 services need to connect to.

The second, Ports and protocols used by Office 365 lists all the ports.

MS Office 365 - Office Suite Installation

Having recently under gone an Enterprise deployment of Microsoft Office 2013
This post will consolidate all posts Related to the experience. This should hopefully offer guidance and gotchas to be aware of.

Setup, Packaging and Deployment

Click to Run tool Usage for enterprise Deployments

Troubleshooting and Issues:

Users Unable to Activate

Office 365 - office fails to activate, and users cant sign in

We ran into an Issue where users office installs wouldn't activate and the users were unable to sign into portal.office.com. When we looked at the tickets, we noticed all the users had Apostrophies in their last name....

Many People have Special characters, like apostrophes, in their email addresses. Names like O'Neil are common and if your organization uses first.last as primary smtp, You have a problem.While an email address like Paul.O'Neil@contoso.com is perfectly valid  in an On Premise exchange environment, Office 365 hates the apostrophe, and as a result, the user can't login. Whats worse is that Office itself wont activate, and puts the user into trial mode - awesome end user experience.

Remember Microsoft Says Primary email must match the Users UserPrincipleName Attribute, the simplest solution is to add a New Primary SMTP address without the apostrophe (Paul.ONeil@contoso.com) , and make the current apostroph'd (Paul.O'Neil@contoso.com) address a secondary.Remove the apostrophe from the UserPrincipleName, trigger a resynch with office 365 and you should be good.

Office 365 - Office 2013 Click to Run Enterprise Deployment.

Office 365 Changes everything you know about Enterprise deployments of applications. The first thing is that Office is licensed per user and will need to authenticate with microsoft. The second 
 is that the office application itself is actually a self Contained APP-V package - so installation requires the use of a Office Deployment tool to perform local enterprise deployments.

Unfortunately, this tool is unlike any other previous office deployment tool.

Tracking Per user Licensing.

There are 3 methods for tracking licensing. First we can have separate  Microsoft online accounts. these work similarly to how a users personal Hotmail account works. Users get a <user>@corp.onmicorsoft.com address and authenticate using that. These exist solely in Microsoft's environment, and users need to sign into office the first time they use it.

the Second option is to use Microsoft's Dir Synch tool to Copy your active directory to their directory. This automates things, but as the users domain account and Microsoft online account are different, they must still login to office.

The third and Final option is to use ADFS to federate your active directory with MS. In this case, Microsoft online refers authentication back to your active directory via AD FS, and this allows office users to get single signon, so they are not prompted to sign into office on first use.

 Installing Using the Click to Run Tool.

The Office deployment kit includes the clicktorun tool. You can download the Office deployment kit at http://www.microsoft.com/en-us/download/details.aspx?id=30344
The Click to run tool gets passed an XML file that tells it how to configure the Install. The XML File allows you to specify what Products and Languages to install (Or exclude) Below is an example Config.xml . Microsoft offers a reference document as well.

 <Configuration>  
   <Add SourcePath="\\mg145.contoso.com\pkgsource\Microsoft\Office365\Office\" version="15.0.4641.1003" OfficeClientEdition="32">  
   <Product ID="O365ProPlusRetail">  
    <Language ID="en-us" />  
    <ExcludeApp ID="Access" />  
    <ExcludeApp ID="InfoPath" />  
    <ExcludeApp ID="Project" />  
    <ExcludeApp ID="Publisher" />  
    <ExcludeApp ID="SharePointDesigner" />  
    <ExcludeApp ID="Groove" />  
   </Product>  
  </Add>   
  <Display Level="full" AcceptEULA="TRUE" />   
 </Configuration>  

Once you have the Config file created, You need to download the office install to the share you created. the command setup.exe /download <path of Configuration.xml file> will do this.

Actually installing office requires you to call >setup.exe /configure <path of Click-to-Run Configuration.xml file>

Microsoft offers documentation on the Click to Run tool At http://technet.microsoft.com/en-nz/library/jj219422.aspx

Adding Components.

In our above example you will notice we excluded Publisher. We can re-add publisher by calling a separate XML file and choosing the additional product to install. Compare the XML Below to the ProPlus one above.

 <Configuration>  
   <Add SourcePath="\\mg145.contoso.com\pkgsource\Microsoft\Office365\Office\" version="15.0.4641.1003" OfficeClientEdition="32">  
   <Product ID="PublisherRetail">  
    <Language ID="en-us" />   
   </Product>  
  </Add>   
  <Display Level="full" AcceptEULA="TRUE" />   
 </Configuration>  

At Present you can use the Following Product codes:

• AccessRetail
• ExcelRetail
• GrooveRetail
• InfoPathRetail
• LyncEntryRetail
• LyncRetail
• OneNoteRetail
• OutlookRetail
• PowerPointRetail
• PublisherRetail
• SPDRetail (SharePoint Designer)
• WordRetail

 Some Office 365 Subscriptions also Include Visio and/or Project

• VisioProRetail
• ProjectProRetail
• VisioStdRetail
• ProjectStdRetail

to Install the component call >setup.exe /configure <path of specific Click-to-Run Configuration.xml file>

 Uninstalling Office

You can remove everything by calling setup and specifying the following config:

 <Configuration>  
    <Remove All="True" />  
 </Configuration>  

You can also remove individual packages by specifying a product id. All the product ID's listed above are also valid here.

<Remove>
    <Product ID="PublisherRetail" />
</Remove>  

Shared Computers

Shared Computer Activation: http://technet.microsoft.com/en-us/library/dn782860.aspx

Repairing Office.

there are 2 modes for repairing office. the first is online mode and downloads the entire product and installs it. This is bad, because it completely ignores any customizations you may have done.

A quick repair will refresh the install. This will not add adtional prodcuts thet were previously turned off.

Both repairs can be done from Programs and Features, Select office, Click Change, and you will be prompted to choose.

It is also possible to issue the commands locally on a system. This is handy if you need to automate a change. For example, If you install office 2013 while 2010 is still on the system, File associations will break if you remove office 2010. to repair them, you will need to run a quick repair. For example - to do a Online repair you can issue the following:


"C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe" scenario=Repair platform=x86 culture=en-us RepairType=FullRepair DisplayLevel=False

Note that the Clicktoruntool path changes based on weather the os is 32 or 64bit.
 for 64-bit operating systems:
“C:\program files\Microsoft Office 15\ClientX64"
 for 32-bit operating systems:
“C:\program files\Microsoft Office 15\ClientX86"

A full reference is available at http://technet.microsoft.com/en-us/library/jj219426.aspx

Surface 3 - SCCM task Sequence Spordically Fails.

Boot The device by pressing power and holding down the Down volume to boot from USB. You can release the Down volume when the Surface logo appears.

It will then start recovery, and allow you to choose a Boot device. We choose, usb, and The device reboots into the Task Sequence.



Once running, we noticed that some would randomy fail to go.

On investigation, we discovered that the Date and Time were incorrect, and  this was causing the failure.

Press F8
Enter Time - Update the time to Current
Enter Date - Update date to Current.

Click Finish on the tasksequence error Screen, and in the cmd window enter tsbootshell, and press Enter to restart the sequence. (Dont close the window, however)

Remotly Get Group Policy Application on a Device

The Following command will give you a nice HTML Report of all the policy settings which are applying on a remote computer, including which policy the setting comes from in case of a conflict.

gpresult /s COMPUTERNAME /user DOMAIN\USERNAME /h outputfile.html

Make sure the account you specify has rights to the Computer you are running against.

Shedding the Office Landline

The Modern office worker often finds themselves with 3 telephony devices on their desk - A Landline phone, A Mobile Phone, and MS Lync used for video conferencing. This often leads to a collection of numerous headsets.

Enter the Jabra Pro 9465 Duo Headset. this is the only headset I am aware of that works with Lync and PC Based Soft phones via USB, A Mobile via Bluetooth, and a traditional desk phone. Setup of the headset, and switching between options is accomplished via a touchscreen on the headset base. (Left Swap Between Mobile and PC)

Since the object of the headset was to ditch my desk phone, I have not tried it with a Landline Phone. The PC integration was seamless, and the driver installed when the base station was connected via USB. Lync picked up the headset right away and i was able to make calls.

The mobile integration is the Best part. The base paired with my phone, a Blackberry Z30 during initial setup. When paired I can pickup and hangup the phone via the touchscreen. this allows me to access BlackBerry's voice dialing, which is handy, however, the touchscreen also can present a dial pad allowing me to make calls with the blackberry while it is still holstered and clipped to my belt. (Right: dial your phone while holstered)

The headset itself is quite clunky compared to either of the 2 Plantronics devices I used previously, however it is not uncomfortable.