Unified Communications Analytics 8.8.3

About AD synchronization methods for hybrid Exchange Online

For hybrid Exchange Online environments, there are several different tools that are used to synchronize users and mailboxes between on-premise Active Directory and Azure Active Directory.

When you configure the Exchange Online Hybrid User Configuration or the Exchange Online Hybrid Mailbox Configuration data source, you must select the synchronization method that is deployed in your environment.

Essentially, all the different synchronization options use one of two methods to synchronize on-premise Active Directory to Azure Active Directory.

Table 24. Hybrid synchronization methods for on-premise Active Directory and Azure Active Directory.
Synch method	Synchronization tool and environment	On-premise AD attribute	Azure AD attribute
Method 1	Azure AD Connect (with Exchange 2016/2019)	msds-ExternalDirectoryObjectId	ExternalDirectoryObjectId
Method 2	Azure AD Connect (without Exchange 2016/2019) Azure AD Connect (upgraded from DirSync) Azure AD Sync (all environments) DirSync (all environments)	ObjectGUID	ImmutableId

About PowerShell collection method options

in the Exchange Online (Hybrid and Native) data sources, you have an option to select the method that PowerShell uses to collect data. In Advanced Settings under the Exchange Online PowerShell Connection Parameters section, you can have PowerShell use either a paging method or a streaming method, depending on the stability of your network environment.

Table 25. PowerShell Collection Method
Method	Recommended use
Paging	Collects data through multiple requests, similar to server-side paging. Low memory consumption. Suitable for less stable network environments.
Streaming	Collects all data through a single request. Collection time is significantly reduced but memory consumption is relatively high. Suitable for extremely stable network environments.

Creating an Exchange Online Hybrid User Configuration data source

The Exchange Online Hybrid User Configuration data source gathers information about users and distribution groups in a hybrid environment only.

By default, the data source collects only direct members of groups. For example, if a distribution group contained 10 users and 14 distribution groups, the number of direct members would be counted as 24.

If you want to collect the effective members (direct and indirect) for a group you can use the Advanced settings in the Collect Effective (Direct and Indirect) Members for Groups section. For example, if you collect from a distribution group that has 10 user members and one distribution group member (that has 20 members), the number of direct members is 11 but the number of effective members is 30.


	TIP: For some fields you can enter multiple values separated by a semi-colon (;). For details, see Entering multiple values in a field .

To set up an Exchange Online hybrid user configuration collection

Click the gear icon

on the home page side bar.

Click Data Collection.

Click + beside the name of the target environment.

Select the Exchange Online Hybrid User Configuration check box.

Enable the data collection for this data source.


	NOTE: If you have installed more than one Data Engine (Collector), you have the option to select a different computer that hosts a data collector.,

Modifying the collection schedule

By default the data collection is set to run every 6 hours, aligned to midnight UTC. You can modify the run interval or you can set the collection to run at a specific time on specific days.

Set the schedule for the data collection:

Click Run job every: and select an hourly interval.

- OR -

Click Run job at: and select the specific job run time, the number of days between each job run, and a start date.

Selecting data to collect

Select the types of data that you want to collect.

•

For hybrid users, you have the option to have Azure AD attributes overwrite the on-premises AD attributes collected by the Domain Controller data source. If you want the Azure AD attributes to appear in insights for hybrid users, select Azure AD attributes for hybrid users (overwrites the on-premise AD attributes).

•

By default, the data source collection gathers direct members of standard distribution and security groups. If you want to also collect direct members for dynamic distribution groups, select the Direct Members check box under the selected Dynamic Distribution Groups check box.

Specify Windows credentials to be used for the LDAP connection or select the Use Data Engine service credential option. See Permissions needed for the Exchange Online Hybrid User Configuration data source .

Specify the Office 365 credential to be used to collect the user configuration data through remote PowerShell.

To improve data collection performance you can provide multiple credentials.


	TIP: Office 365 has a per-user throttling mechanism to protect the Exchange systems. It is recommended that you use dedicated user accounts on this page to avoid throttling caused by concurrent usage of the same account in other applications.

Specifying the PowerShell connection

Select the authentication method to be used for remote PowerShell:

•

Basic

In the near future, Microsoft will discontinue support for Basic Authentication for remote PowerShell access to Exchange Online.

•

OAuth 2.0

To use OAuth modern authentication when accessing Exchange Online with remote PowerShell you must have the Exchange Online PowerShell module (v1 or v2) installed. For more information, see Installing the Exchange Online PowerShell module .

Active Directory Synchronization

Select the tool that is used to synchronize your Azure Active Directory with on-premise Active Directory.

•

Azure AD Connect with Exchange 2016/2019

•

Azure AD Connect

•

Azure AD Sync

•

DirSync


	NOTE: If you use Azure AD Connect and have Exchange 2016/2019 (mixed or native environment), select Azure AD Connect with Exchange 2016/2019 for optimal performance.

For information about synchronization methods, see About AD synchronization methods for hybrid Exchange Online .

Advanced settings (not required for most deployments)

•

If you want to specify one or more explicit domain controllers instead of automatically discovering the domain controller, click Show Advanced Settings in the LDAP Collection Parameters section. For more information, see Specifying explicit domain controllers for LDAP connections . The domain controller must be a global catalog server.


	NOTE: If the Data Engine is in a different forest from the data to be collected, specify the domain controller you want to use for data collection. If you leave the default setting to automatically discover domain controller, the data collector selects a domain controller from the forest that hosts the Data Engine, not a domain controller from the forest from which you are collecting the data.

•

By default, the data source collects direct members of groups. If you want to collect effective members (direct and indirect) for groups, click Show Advanced Settings in the Collect Effective (Direct and Indirect) Members for Groups section. You can select to collect effective members for specified groups or for all groups.

If you select Effective members for specific groups and click Add group, you have the option to add each group individually or you can enter a list of groups, each entry separated by a semi-colon (;).


	IMPORTANT: If you collect effective membership for many groups, it can have significant impact on performance and storage requirements.

•

To specify the type of collection method used for PowerShell, click Show Advanced Settings in the Exchange Online PowerShell Connection Parameters section. You can select Paging or Streaming. For details about each method, see About PowerShell collection method options .

Click Save.

Creating an Exchange Online Hybrid Mailbox Configuration data source

For a hybrid Office 365 environment, you can create a mailbox configuration collection to gather mailbox statistics such as mailbox size, mailbox permissions, and remote devices from Exchange Online mailboxes. For a native Office 365 environment, see Creating an Exchange Online Native Mailbox Configuration data source .

For more information about credential prerequisites, see Permissions needed for the Exchange Online Hybrid Mailbox Configuration data source .


	TIP: For some fields you can enter multiple values separated by a semi-colon (;). For details, see Entering multiple values in a field .

To set up an Exchange Online hybrid mailbox configuration collection

Click the gear icon

on the home page side bar.

Click Data Collection.

Click + beside the name of the target environment.

Select the Exchange Online Hybrid Mailbox Configuration check box.

Enable the data collection for this data source.


	NOTE: If you have installed more than one Data Engine (Collector), you have the option to select a different computer that hosts a data collector.,

Modifying the collection schedule

By default the data collection is set to run every 6 hours, aligned to midnight UTC. You can modify the run interval or you can set the collection to run at a specific time on specific days.

Set the schedule for the data collection:

Click Run job every: and select an hourly interval.

- OR -

Click Run job at: and select the specific job run time, the number of days between each job run, and a start date.

Selecting data to collect

Select the types of data to collect:

•

Mailbox permissions

•

Mailbox (permissions)

•

Recipient permissions (Send As permissions)

•

Delegates (Send On Behalf Of permissions)

•

Mobile devices

•

Mailbox statistics

•

Personal Archive Mailboxes (Configuration)

•

Personal Archive Mailboxes (Statistics)

Specify the target mailboxes you want to collect:

•

All Exchange Online mailboxes

•

Specific Exchange Online mailboxes

For specific mailboxes, you can enter the common name or email address of a mailbox, a group. or a dynamic distribution group.

Specify the Windows credentials to be used for the LDAP connection or select the Use Data Engine service credential option.