Solved

Distribution groups within exchange - multi tenanted

Posted on 2016-10-07
16
46 Views
Last Modified: 2016-11-11
Hi
I have created a multi-tenant exchange server and the users are in the correct OU/GALS etc.

I am having an issue with tenant distribution groups - I use the following command to create the group:

New-DistributionGroup -Name 'test' -OrganizationalUnit 'test.co.uk/exchange tenant/tenant1'

Then I use:

Set-DistributionGroup -Identity 'test' -CustomAttribute test1

This changes the email to @test.co.uk and also ensures it is in the GAL for the tenant1.


The problem is, when I use the EMC at the top level I see group and when I want to add a new user it lists everyone in the organisation and all tenants.
Is there anyway I can set the distribution group to only allow me to see users who have the test1 attribute set (instead of seeing every person listed) ?
0
Comment
Question by:Member_2_7970364
  • 5
  • 5
  • 5
  • +1
16 Comments
 
LVL 14

Accepted Solution

by:
Todd Nelson earned 500 total points (awarded by participants)
ID: 41833713
You will need to create a dynamic distribution group to set conditions based on attributes.

New-DynamicDistributionGroup -Name "Test DG" -IncludedRecipients "AllRecipients" -ConditionalCustomAttribute1 "Test" -OrganizationalUnit "contoso.com/My OU" -Alias "Test DG" -RecipientContainer "contoso.com"

Open in new window

0
 

Author Comment

by:Member_2_7970364
ID: 41833800
I dont want a dynamic one .. I want a normal distribution group that when I select members and add it only lists members within tat specific OU
0
 
LVL 14

Expert Comment

by:Todd Nelson
ID: 41833845
Don't believe you can do what you want with a "normal" DG because they cannot be condition-based.  And based on what you are described your need is, you need a DG that is condition-based which can only be accomplished with dynamic DGs.

If I am understanding your need different then what you are intending, please provide further clarification (maybe a screenshot or a textual example).
0
 
LVL 38

Expert Comment

by:Adam Brown
ID: 41834212
I'm assuming you're using Exchange 2010, since you mention EMC, otherwise let me know. In the EMC, you should be able to change the Scope of results to just the OU you want. https://technet.microsoft.com/en-us/library/bb124527(v=exchg.141).aspx has instructions. I don't know if that setting applies to the Group Member selection UI, though. You can try doing that, though.

When working with a multi-tenant environment, though, it's usually best to use the Management Shell to do things. That's the main reason the Exchange 2010 Hosted installation doesn't even include the EMC. In EMS, you would basically just limit your get-mailbox cmdlet with the -organizationalunit switch to sift through the mailboxes in just one OU instead of the whole environment.
0
 
LVL 14

Expert Comment

by:Todd Nelson
ID: 41834352
If you need to create a DG with a filter targeting a specific OU, then you have to use a dynamic DG.

New-DistributionGroup does not have the ability to do filtering.

Your first command...


New-DistributionGroup -Name 'test' -OrganizationalUnit 'test.co.uk/exchange tenant/tenant1'

...Basically creates a DG named "test" in an OU named "tenant1".

Your second command...


Set-DistributionGroup -Identity 'test' -CustomAttribute test1

Shouldn't work because you don't specify which custom attribute you are setting. You will need to state which custom attribute by using the correct parameter ... CustomAttribute1-CustomAttribute15.

Giving you the benefit of the doubt that you defined a valid parameter, then the "test" DG is assigned a custom attribute of "test1".

What then are you planning to do with it?  IMO, it does nothing and will only do something if you manually add group members.

Just because the DG is created in the "tenant1" OU with a custom attribute of "test1" doesn't mean that any users are assigned as members of the group.  And that's because a "normal" DG does not have the ability to filter.

If you want to filter based on OU, try this command to create a dynamic DG in the "tenant1" OU that has a filter set to look at all recipient types in the "tenant1" OU and dynamically assign them as members of the DG because they reside in the OU specified by the filter...

New-DynamicDistributionGroup -Name "Test" -IncludedRecipients "AllRecipients" -RecipientContainer "test.co.uk/exchange tenant/tenant1" -OrganizationalUnit "test.co.uk/exchange tenant/tenant1"

Open in new window


References...


Let me know.


P.S.  If you are running a multi-tenant Exchange environment, don't you have support or some sort of partnership with Microsoft specific for your organization that would allow you to call at any time for assistance?
0
 

Author Comment

by:Member_2_7970364
ID: 41835021
Hi

I may have explained this badly (sorry)  ... so I will attempt with pictures:

On our exchaneg server we have the top level - orglevel attached.

When I create a user in the avonvale OU I enter the following command:

New-Mailbox -Name 'Dawn Gilroy' -Alias 'dawn.gilroy' -OrganizationalUnit 'company.co.uk/ExchangeTenants/avonvets' -UserPrincipalName 'bob.smith@avonvets.co.uk' -SamAccountName 'bob.smith' -FirstName 'Bob' -LastName 'Smith' -AddressBookPolicy 'Avonvets'

Then I run:

Set-Mailbox bob.smith@avonvets.co.uk -CustomAttribute1 "Avonvets"

This works perfectly - Bob is in the correct OU and within the Avonvets users and can only see users within Avonvets


I then want to create a group called: "Avoncale Test1", so I run the command:

New-DistributionGroup -Name 'Avonvale test1' -OrganizationalUnit 'company.co.uk/ExchangeTenants/avonvets'

and

Set-DistributionGroup -Identity 'Avonvale Test1' -CustomAttribute1 Avonvets

And this works perfectly .. creates a group that is in the right OU and only members of the Avonvets can see  - attached pic

if I then go into the EMC and into groups .. i see eveything within the org .. which is OK (see attached group layout)

My problem is .. from within the MMC when I want to add users to that group I see everyone within the WHOLE of the organisation /Ous etc...  whereas I only want to be able to select users that are in the avonvale OU  - see attached issue

I hope this has now made sense.


When I run the command as suggested to create a dynamic group:

New-DynamicDistributionGroup -Name "Test11" -IncludedRecipients "AllRecipients" -RecipientContainer "company.co.uk/ExchangeTenants/avonvets" -OrganizationalUnit "company.co.uk/ExchangeTenants/avonvets"

the group does not even show in the users list of groups (avonvets - All Groups) .. see attached mising group


I know I have replaced the co.uk with the word company !!
groups.png
org-layout.png
group-layout.png
issue.png
missing-group.png
0
 
LVL 14

Expert Comment

by:Todd Nelson
ID: 41835105
Let me ask this...

You are needing to restrict the avonvets.co.uk users to only see other users within avonvets.co.uk?

So you need to restrict what they see in their address lists?
0
 

Author Comment

by:Member_2_7970364
ID: 41835222
Yes avonvets can only see people within its own GAL ... and this works perfectly.
We have created users in the other companies and they can only see their own companies etc..

The top level company can see everyone - this is fine also

It is just the groups from an administrative point of view ... at the moment the groups I create people can only see them within their own company ...  but ideally the administrator when adding people into the groups should only see the people within that OU
0
 
LVL 14

Expert Comment

by:Jason Crawford
ID: 41835758
So what you're talking about is the local helpdesk for the tenant in question, correct?  They should have the ability to perform common administrative tasks, like modifying group membership, but no permissions that extent outside their own tenant, correct?  

Assuming this is what you're referring to it sounds like a typical multi-tenant setup, and I've had this exact request myself from one of my tenants.  Just let me know if all this is correct and I'll provide the steps for accomplishing what you're requesting.

On a side note, Dynamic Distribution Groups are great for dynamically adding users to groups based on one or more conditions, but it does nothing to maintain tenant separation.
0
 

Author Comment

by:Member_2_7970364
ID: 41835790
Hi Jason

This is is correct ... it merely for the administration
0
 
LVL 14

Expert Comment

by:Jason Crawford
ID: 41835798
Right I gotcha...basically allowing end-users to manage DGs which they can't do out of the box.  It's actually a lot more involved than I initially thought and involves RBAC roles and managing DGs out of the EAC, not MMC.  If an end-user logs in to the EAC and has the appropriate RBAC roles assigned they will be able to manage DG membership and will only have a view of their own tenant to work with.  

https://blogs.technet.microsoft.com/rmilne/2015/05/27/allow-users-to-manage-distribution-groups-without-creating-new-onesexchange-2013-redux/
0
 
LVL 14

Expert Comment

by:Jason Crawford
ID: 41836838
On a side note, do you use any kind front end application like Hosting Controller to handle the tenant separation configuration or are you doing everything manually?  I've done it both ways, and I found the additional cost of Hosting Controller well worth it.
0
 

Author Comment

by:Member_2_7970364
ID: 41843186
Doing everything manually
In fairness didnt know anything about the hosting controller .. so will look into that
Thanks
0
 
LVL 14

Expert Comment

by:Jason Crawford
ID: 41881887
No comment has been added to this question in more than 21 days, so it is now classified as abandoned.

I have recommended this question be closed as follows:

Accept: Todd Nelson (https:#a41833713)

If you feel this question should be closed differently, post an objection and the moderators will review all objections and close it as they feel fit. If no one objects, this question will be closed automatically the way described above.

exchangepro
Experts-Exchange Cleanup Volunteer
0
 
LVL 14

Expert Comment

by:Jason Crawford
ID: 41883354
A dynamic distribution group would not be the solution in a multi-tenant Exchange environment, and I'm not sure how my contribution was ignored as the solution.
0
 
LVL 14

Expert Comment

by:Todd Nelson
ID: 41883976
I agree with Jason.
0

Join & Write a Comment

Follow this checklist to learn more about the 15 things you should never include in an email signature from personal quotes, animated gifs and out-of-date marketing content.
Is your Office 365 signature not working the way you want it to? Are signature updates taking up too much of your time? Let's run through the most common problems that an IT administrator can encounter when dealing with Office 365 email signatures.
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…
This video discusses moving either the default database or any database to a new volume.

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now