Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 753
  • Last Modified:

Exchange Online Protection transition from Forefront Online Protection for Exchange

Anyone here use Forefront Online Protection for Exchange (FOPE) and have your services transitioned over to Exchange Online Protection? The process is confusing, because Exchange Online Protection doesn't seem to show the distribution groups from the organization whereas FOPE used to show these. I've already installed the Azure Directory Sync Tool.

Under recipients in the Exchange Admin Center, all I see are "Users" and "Contacts". Nothing for distribution groups.

I called into their support but got a guy with a thick accent and probably overseas as there seemed to be a delay where he could hear me. I couldn't make much sense of what he was telling me and i don't think he understood what I was trying to relay to him. He seemed to relay that they are aware of the distribution groups on the back end but they won't show on EAC.

I don't want to switch over my MX records until I'm sure that EOP can handle emails to the distribution groups. help!
2 Solutions
Shabarinath RamadasanInfrastructure ArchitectCommented:
We have a similar infrastructure but using Hybrid setup. We have FOPE as part of the O365 Subscription however, yet to start the mail routing through FOPE.

Could you please let me know if you are doing a full sync or partial sync from On-Premise to cloud? I have done a partial sync based on a custom attribute and I could see the groups which I have set the value correctly to be synced.

Cheers !
HornAlumAuthor Commented:
we are doing a full sync i believe. Partial sync was not an option in the azure tool
Svet PaperovIT ManagerCommented:
We also have been transferred to OEP from FOPE. And, I have to say it, I am a little bit disappointed. We had the same setup: Exchange on-premises with FOPE before and it was much easier to manage with more features available.

I tried Azure Sync Tool but I had to revert to In-Cloud management of the addresses because it messed up with my accounts and uploaded far more users (including AD accounts without e-mails addresses) than I actually had in FOPE.

About the distribution groups: I believe the Sync Tool uploads the static distribution groups only but not the dynamic once (at least in my case it was like that). You should be able to see the uploaded groups when you go to Users and Groups – Manage mail contacts.

However, even if the group is not listed, the emails sent to it will be treated and forwarded. EOP does not have Directory blocking yet, as it was in FOPE, so all messages, even for addresses that do not exist in EOP will be forwarded to your Exchange.

Shabarinath Thekkemeppully Ramadasan: how do you do partial Synch? I would like to have it but I didn’t find any configuration option in the current version of Azure Directory Synch Tool. Could you provide more information, please?
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

HornAlumAuthor Commented:
I agree, FOPE seemed much friendlier and granular. I'm not liking EOP so far. I also see some contacts in the 365 console that don't even exist anymore in our current on-premise.

ok ... I just uncovered something really strange.

if you go to the Exchange Admin Console, then Recipients, you only see "Users" and "Contacts"

If you go back to the Office 365 console, then "Users and Groups" and "Manage Mail Contacts", you see "Groups" and "contacts", and wha-la, there are the groups.

what the crap? this is so disorganized
Svet PaperovIT ManagerCommented:
I completely agree. And I found the same things.

That's way I decided not to use Dir Synch.

In FOPE, Dir Synch was very useful because of Directory blocking but since there is no Directory blocking in EOP yet, and the end-user cannot logon to his Quarantine.. again yet, I don't see way should I complicate my life with this synch.

It's "wait and see" for me.
HornAlumAuthor Commented:
I can't see not using DirSync right now though, because there's no way i want to manage accounts/groups in two separate places.
Robberbaron (robr)Commented:
I too have been forced into the transition and DIrSync does not sync mail-enabled public folders at all.
1. My distrib groups got synced, including some that used to be internal-only !  So they do show up for me using DirSync.  Where are they in your AD tree ?  (mine were below our OrgUnit)

2. DirectoryEdge blocking is on for us (maybe cause MS did much of the migration automatically) and working.....  But this BLOCKED our main  mail@xyz.com as this an email address is to a public folder named ReceptionMail.  And unless you look hard, I didnt realise that PF's were not synced like they were with the FOPE sync tool.

There is a script floating around that creates contacts for each mail-enabled public folder and these should sync but no luck for me.

3. @HornAlum.. I cant workout how you saw the groups ....
HornAlumAuthor Commented:
i was able to find the location where the groups were stored

Featured Post

Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now