Migrating an archive from Enterprise Vault to Office 365
This section outlines steps of the migration of a single test archive within Enterprise Vault to an Office 365 mailbox.
Prerequisites
Complete these steps before beginning the migration:
·Enable all modules.
·Enable appropriate Active Directory Domains for scanning.
·Add an Enterprise Vault Environment for the migration.
·Create a Link Database for the source archives.
·Configure Module Mappings for the source archives.
|
|
NOTE: It is assumed that the mailbox has been moved to Office 365 already and that it is the EV Archive that is to be moved. |
Office 365 Global Administrator
In addition, it is necessary to configure the Archive Shuttle to Office 365 connection to use credentials that have sufficient privileges.
User Principal Name (UPN)
When mailbox information is gathered from Office 365, it is matched against local Active Directory users by using the Primary SMTP Address.
This means that the local Active Directory users must have the same UPN as the Office 365 users, or have the same Primary SMTP Address.
|
|
NOTE: Archive Shuttle does not support automatic matching of mailboxes to more than one set of Active Directory users (for example, matching to both on-prem and cloud users) when the same UPNs are present in both Active Directory instances. |
Configure the Office 365 Module
Details can be found in the Archive Shuttle Installation Guide.
Create Office 365 link
In order to migrate an archive to Office 365, an Archive Shuttle Office 365 Link is required. Follow these steps to configured it:
1.Go to the Links page.
2.Click Office 365 in the Actions Bar.
3.Click Create Link.
4.Give the link a name, for example, Office 365.
5.Click Create.
The new link needs to have Archive Shuttle Modules associated with it, and the Staging Area Path needs to match the EV Export Module.
Sync mailbox data
Before you can map a container in the source environment to an Office 365 target, select the Office 365 link on the Links administration page, and click Sync Mailboxes in the Actions Bar.
Map containers - for the test archive
In order to migrate a test archive from Enterprise Vault to Office 365, the source and target containers must be mapped. This can be done as follows:
1.Go to the Bulk Mapping page.
2.Type the beginning of the archive name in the Name filter. Click Apply, located at the right of the filter row.
|
|
NOTE: If the test archive is not displayed, go back to the EV Environment page and click Sync all AD Users, then select the Vault Store where the source archive is located and issue a Run Now for Archive Gathering. |
3.Select the checkbox next to the test archive, and click Add Mappings.
|
|
NOTE: A short wizard runs, gathering information related to the mapping for the select archive. (Multiple archives can also be selected.) |
4.On the Target Container Type screen, select Office 365, and click [Next].
5.Choose whether the migration should be performed to an Office 365 Mailbox or Personal Archive, and click [Next].
6.Select the link to use for this operation, and click [Next].
7.Choose the Workflow Policy for this migration, and click [Next].
8.Choose the Filter Policy for this migration, and click [Next].
9.On the Container Mapping Settings screen, select Enabled for both Migration Status and Item Gathering Status, and click [Next].
10.Review the summary screen before clicking [Confirm].
Review Stage 1 Status
A few minutes after the mapping is created, Archive Shuttle instructs the appropriate modules to start the actions defined in the mapping. The progress of this stage of the migration can be reviewed as follows:
1.Go to the Stage 1 (Sync Data) page.
2.Type the beginning of the archive name in the Name filter. Click Apply at the right of the filter row.
3.Once the source archive displays, click Refresh from time to time to show the progress of the export of the archive and the ingesting of the data into Office 365. Continue to click Refresh until both export and import reach 100%.
Validate exported data
If there is a large amount of data to export and import, then it will be possible to see the progress bars for the Stage 1 Status move by clicking Refresh from the navigation bar on the Stage 1 (Sync Data) page of the user interface.
In addition, you can use Windows Explorer to view the export/import storage area data on the disk.
Also, at this time it will be possible to login to Outlook or Outlook Web Access as the test user. The migrated data will be present in the Office 365 mailbox, and can be freely opened and manipulated.
Enable Stage 2
Before enabling Stage 2, the switch, for the test archive, the Stage 1 (Sync Data) page should be checked for issues such as failed item-export or item-import.
To enable Stage 2 for the test archive, perform the following steps:
1.Go to the Stage 1 (Sync Data) page.
2.Select the checkbox next to the test archive, and click Enable Stage 2 in the navigation bar.
3.When the Stage 1 Status page is refreshed, there should be a green and white check mark in the Stage 2 Enabled column.
Stage 2 is the switchover to the target environment. A final synchronization is performed of archived items from the source environment to the target environment, before several additional migration tasks are performed.
Review Stage 2 Status
After a few minutes, the progress of the test archive migration will be visible in the Stage 2 Status page, as follows:
1.Go to the Stage 2 (Switch User) page.
2.Type the beginning of the archive name in the Name filter. Click Apply at the right of the filter row.
|
|
NOTE: If the archive is not displayed, wait one to two minutes and click Refresh in the navigation bar. |
3.Once the source archive is displayed, you can click Refresh from time to time to show the progress of the final stages of the archive migration. By default, since the workflow policy which was selected was Office 365 (without archive deletion), the following steps will be performed by Archive Shuttle:
a.Rename the source archive
b.Collect any remaining items for migration
c.Import the remaining items in to the target
d.Delete any Enterprise Vault shortcuts in the Office 365 mailbox
e.Change any archive-pending items back to normal items in the Office 365 mailbox
Verify data has been migrated
Once all of the Stage 2 operations have been completed, the Stage 2 (Switch User) for the test archive will have a green and white check mark in the Finished column.
In addition Outlook or Outlook Web Access can be used to access the Office 365 mailbox to verify that all data from the Enterprise Vault archive is present and accessible.
Additional details on Enterprise Vault to Office 365 Mailboxes migration
Introduction
This section explains what the requirements are for an Enterprise Vault (EV) to Office 365 migration, and then covers the basic steps that should be followed to start such a migration.
Requirements
The following is a list of requirements.
|
Requirement |
Description |
|---|---|
|
Modules installed on source |
The EV-type modules should be installed on each appropriate source Enterprise Vault server involved in the migration. The EV import module is not required on these machines. |
|
Modules installed on appropriate bridgehead to reach target |
Office 365 and Post Processing modules are the two which are primarily needed to work with this type of migration. |
|
AD Collector module installed |
An AD Collector module should be installed so that it can collect user-level information for the migration project. |
|
Staging Area created |
One or more staging areas should be setup, of an appropriate size and should be excluded from virus scanners. |
|
Ingest accounts configured for Application Impersonation |
5 accounts should be configured with Application Impersonation rights, and those accounts should be added to the credential editor on the machine running the Office 365 module. One account should also be configured as a Global Administrator in Office 365, and be marked as that in the credential editor. |
|
Workflows reviewed |
The Stage 2 workflows should be reviewed, and if necessary, customized to meet the needs of the project. |
|
Apply appropriate failed item threshold |
It is best practice to find an appropriate failed item threshold for the project/customer and apply that at the links level. This way all mappings which are created will inherit this value. |
Basic steps
The following are the basic steps to start this type of migration.
|
Step |
Screen |
Description |
|---|---|---|
|
Enable Modules |
Modules |
All Archive Shuttle modules must be enabled, and optionally a schedule for them defined. It is important to verify that none of the modules have a red background (this indicates that Archive Shuttle Core has not had contact with the module) and that the module versions are as expected. |
|
Enable Domains |
Active Directory |
Select and enable one or more domains for synchronization. |
|
Add EV Environment |
EV Environment |
Add the Enterprise Vault source environment. |
|
Add Source Links |
Links |
Ensure that the Default Staging Area is configured correctly. Depending on the migration, the free space, and the number of vault stores being used as the source for the migration, the high water mark can be adjusted upwards. |
|
Add Staging Area |
Links |
Select the newly created link, and map a Shortcut Process Module to it. |
|
Configure Folder-Less Item Handling |
System Configuration |
Many versions of Enterprise Vault allow archiving of items in a folder-less area called the Top Of Information Store. On the System Configuration, enter a folder name to be used for placing the items in the target archive. |
|
Set Office 365 Credentials |
There are two options: Option 1: Service account user name/password Screen: External Application installed by the Office 365 module Run the Archive Shuttle Office 365 Module Credential Editor and supply multiple service account credentials. When running the credential editor, it is important to make sure the account that is logged in is the account used to run the Office 365 service. Archive Shuttle recommends that you add at least as many service accounts as the number of mailboxes that will be handled in parallel (Configured on the System Configuration screen). Option 2: OAuth authentication Screen: Office 365 module Run the Archive Shuttle Office 365Module Credential Editor and add OAuth credentials. Then test the connection. Then, from the Office 365 Module, select the Use modern authentication (OAuth) option. | |
|
Update Shortcut Processing Module Configuration |
System Configuration > Shortcut Processing |
Update the settings so that Use EWS for Processing is enabled. |
|
Consider disabling reminders for appointments in the past |
System Configuration > Office 365 Module |
Consider enabling the option to Disable reminders for appointments in the past. |
|
Map one or more containers |
Manual Mapping/Bulk Mapping |
One or more containers can now be mapped and migration started. |
Determining Enterprise Vault archive owner(s)
Archive Shuttle must determine the owner of a mailbox archive. This section explains how this takes place..
Archive Shuttle takes the owner information of a mailbox archive from the Auto Security Descriptor field within the Enterprise Vault Directory database. The first entry for an archive will be the owner. Take the following three examples:
Simple 1
·Bill usage to: somedomain\simple1
·Permissions tab: somedomain\simple with inherited read, write and delete permissions
Archive Shuttle will see the owner of this archive as simple1.
Simple 2
·Bill usage to: somedomain\simple2
·Manually grant an additional user read, and delete permissions on the archive
·Permissions tab: somedomain\simple2 with inherited read, write and delete permissions. somedomain\someotheruser with manually set read, and delete permissions
Archive Shuttle will see the owner of this archive as simple2.
Simple 3
·Bill usage to: somedomain\simple3
·Grant full mailbox access via Exchange Management Console or Exchange Management Shell
·Permissions tab: somedomain\simple3 with inherited read, write and delete permissions. somedomain\someotheruser also with inherited read, write and delete permissions
Archive Shuttle will see the owner of this archive as simple3.
|
|
NOTE: The order which the archives are listed in the permissions tab in Enterprise Vault does not reflect the order that the accounts are described in the Auto Security Descriptor field. The permissions tab shows the archive permissions in alphabetical order. |
More detail
1.Archive Shuttle resolves the 'Owner' of an Archive as follows:
In the EnterpriseVaultDirectory database, the following SQL is used:
select ADMbxDN, LegacyMbxDN from ExchangeMailboxEntry where DefaultVaultId=@VAULTID
2.Archive Shuttle then does a lookup for the ADMbxDN in Active Directory to get the SID:
LDAP Query: (ADMbxDN=)
If Archive Shuttle does not find the AD object, the archive will be marked as Ownerless and move to the next option.
3.Archive Shuttle then does a lookup for the LegacyMbxDN in Active Directory to get the SID:
LDAP Query: (LegacyMbxDN=)
If Archive Shuttle does not find the AD object, the archive will be marked as Ownerless and move to the next option.
4.We then compare the SIDs we got from ADMbxDN and from LegacyMbxDN, and if both of them match, we have an Owner. If they do not match, they will be marked as 'Ownerless' and move to the next option.
5.If we do not find an entry in ExchangeMailboxEntry, we resolve using the BillingOwner or the AutoSecurityDesc:
select SID from Root inner join trustee on OwningTrusteeIdentity = TrusteeIdentity where VaultEntryId=@ARCHIVEID
|
|
NOTE: Regarding OwnerUserSid versus SID fields in the EVArchive Table on in the Archive Shuttle Directory Database: ·SID is always filled out with the SID which is retrieved from the above steps ·OwnerUserSid has a foreign key constraint on the [User] Table. So Archive Shuttle only fill this out if the SID obtained from EV is actually contained in the Archive Shuttle Directory Database (i.e. has been synced from AD) |
5.The UserSidHistory table is stored Sid history for each user when they were migrated from AD1 to AD2. This SidHistory attribute is part of Active Directory, and Archive Shuttle collects this data from Active Directory directly.
General considerations
The following general considerations should be taken into account for this type of migration:
·A call should be logged with Microsoft to get the throttling limits raised for the duration of the migration, otherwise ingest performance will be reduced.
·When migrating from a pre EV10.0.3 system extraction of data may be slower than expected if Enterprise Vault Collections have been used. Access to the data inside the CAB file is single threaded. This issue does not exist in Enterprise Vault 10.0.3 and later.
·Different flavors of Office 365 license have different size limits, as described here. It is advised to run SQL Queries on the source environment in order to determine if any archives are likely to have.
·Many large items- Many archives have more data in them than is allowed by the Office license.
·It is advised to ensure a high level of Mailbox Parallelism and a low level of item/batch parallelism. This gives least chance to get to throttling limits.
·It is advised to have 5 accounts configured with application impersonation rights in Office 365. This gives least chance to reach throttling limits. Go to the Archive Shuttle Installation Guide for more on application impersonation rights.
Mapping retention categories from Enterprise Vault to Office 365 retention tags
You can collect retention tags from Office 365 and map/apply them in a migration where Enterprise Vault is used as the source, and Office 365 is used as a target.
By default the collection of retention tags is disabled. If you want to make use of this new feature, then the option in System Settings needs to be enabled:
When this is enabled, retention tags will be collected by the Office 365 module.
Retention category mapping can then be performed. The user interface has been extended to allow the mapping between Enterprise Vault retention category and Office 365 retention tag.
During a migration, items will be ingested into Office and two additional attributes will be set/populated:
·PR_POLICY_TAG (GUID of the retention tag)
·PR_RETENTION_PERIOD (Age limit for retention)
PowerShell commands have also been extended to allow for this mapping to process to be performed.
|
|
NOTE: If an item is exported, and there is no retention mapping for it, the item will not ingest. |
There is also the ability to bind Enterprise Vault retention categories with the Office 365 Compliance Retention labels. When the feature is active, PR_POLICY_TAG and PR_RETENTION_PERIOD properties are put into messages properties. This works only with AIP as an ingest protocol. The validation on the existing retention mapping is processed; if this doesnt exist, the ingest is not processed (items are exported only). In the case when Enterprise Vault archive contains items with more retention categories (in case when PST file was imported into archive under another RC as is origin of the EV archive) and only one 1 RC mapping exists, then these items will ingested and stamped with the Office 365 Compliance Retention label.
This is reflected in the UI below:
EV Retention Mappings screen:
Mapping health page has been updated to handle with this missing retention mapping for Office 365.
Archive Shuttle collects ALL retention labels, published or unpublished.
·Published labels are visible via Outlook > Assign Policy.
·Unpublished are hidden for users via Outlook.
Restore Enterprise Vault items associated foreign shortcuts within a user's mailbox to Office 365
You to restore original items from foreign shortcuts in a users mailbox, and remove that shortcut during stage 2.
A foreign shortcut is one which is not from this users archive, but its from another archive which the user has access to. With Enterprise Vault, it will retrieve that item when needed by the user.
Archive Shuttle also has the ability to retrieve these items, and migrate the full item to the users chosen target, and remove the shortcut during stage 2.
To enable this functionality, click the 'Convert EV foreign shortcuts to regular items' under the Shortcut Process Configuration options.
|
|
NOTES: §Archive Shuttle has new workflows and stage 2 commands, eg Enterprise Vault to Office 365 (with restore foreign shortcuts). §Archive Shuttle does not do retention tagging on the restored items, because information about retention is not known for these items. §The shortcut process module performs the retrieval action from Enterprise Vault using the Enterprise Vault API. §It is not required to have an item database associated with the vault store where the item resides. §Emails, appointments, tasks and sticky notes are supported. Contacts are not supported. §Ensure to assign a staging area path to the import link. |