Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 125
  • Last Modified:

Distribution groups within exchange - multi tenanted

Hi
I have created a multi-tenant exchange server and the users are in the correct OU/GALS etc.

I am having an issue with tenant distribution groups - I use the following command to create the group:

New-DistributionGroup -Name 'test' -OrganizationalUnit 'test.co.uk/exchange tenant/tenant1'

Then I use:

Set-DistributionGroup -Identity 'test' -CustomAttribute test1

This changes the email to @test.co.uk and also ensures it is in the GAL for the tenant1.


The problem is, when I use the EMC at the top level I see group and when I want to add a new user it lists everyone in the organisation and all tenants.
Is there anyway I can set the distribution group to only allow me to see users who have the test1 attribute set (instead of seeing every person listed) ?
0
Member_2_7970364
Asked:
Member_2_7970364
  • 5
  • 5
  • 5
  • +1
1 Solution
 
Todd NelsonSystems EngineerCommented:
You will need to create a dynamic distribution group to set conditions based on attributes.

New-DynamicDistributionGroup -Name "Test DG" -IncludedRecipients "AllRecipients" -ConditionalCustomAttribute1 "Test" -OrganizationalUnit "contoso.com/My OU" -Alias "Test DG" -RecipientContainer "contoso.com"

Open in new window

0
 
Member_2_7970364Author Commented:
I dont want a dynamic one .. I want a normal distribution group that when I select members and add it only lists members within tat specific OU
0
 
Todd NelsonSystems EngineerCommented:
Don't believe you can do what you want with a "normal" DG because they cannot be condition-based.  And based on what you are described your need is, you need a DG that is condition-based which can only be accomplished with dynamic DGs.

If I am understanding your need different then what you are intending, please provide further clarification (maybe a screenshot or a textual example).
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 
Adam BrownSr Solutions ArchitectCommented:
I'm assuming you're using Exchange 2010, since you mention EMC, otherwise let me know. In the EMC, you should be able to change the Scope of results to just the OU you want. https://technet.microsoft.com/en-us/library/bb124527(v=exchg.141).aspx has instructions. I don't know if that setting applies to the Group Member selection UI, though. You can try doing that, though.

When working with a multi-tenant environment, though, it's usually best to use the Management Shell to do things. That's the main reason the Exchange 2010 Hosted installation doesn't even include the EMC. In EMS, you would basically just limit your get-mailbox cmdlet with the -organizationalunit switch to sift through the mailboxes in just one OU instead of the whole environment.
0
 
Todd NelsonSystems EngineerCommented:
If you need to create a DG with a filter targeting a specific OU, then you have to use a dynamic DG.

New-DistributionGroup does not have the ability to do filtering.

Your first command...


New-DistributionGroup -Name 'test' -OrganizationalUnit 'test.co.uk/exchange tenant/tenant1'

...Basically creates a DG named "test" in an OU named "tenant1".

Your second command...


Set-DistributionGroup -Identity 'test' -CustomAttribute test1

Shouldn't work because you don't specify which custom attribute you are setting. You will need to state which custom attribute by using the correct parameter ... CustomAttribute1-CustomAttribute15.

Giving you the benefit of the doubt that you defined a valid parameter, then the "test" DG is assigned a custom attribute of "test1".

What then are you planning to do with it?  IMO, it does nothing and will only do something if you manually add group members.

Just because the DG is created in the "tenant1" OU with a custom attribute of "test1" doesn't mean that any users are assigned as members of the group.  And that's because a "normal" DG does not have the ability to filter.

If you want to filter based on OU, try this command to create a dynamic DG in the "tenant1" OU that has a filter set to look at all recipient types in the "tenant1" OU and dynamically assign them as members of the DG because they reside in the OU specified by the filter...

New-DynamicDistributionGroup -Name "Test" -IncludedRecipients "AllRecipients" -RecipientContainer "test.co.uk/exchange tenant/tenant1" -OrganizationalUnit "test.co.uk/exchange tenant/tenant1"

Open in new window


References...


Let me know.


P.S.  If you are running a multi-tenant Exchange environment, don't you have support or some sort of partnership with Microsoft specific for your organization that would allow you to call at any time for assistance?
0
 
Member_2_7970364Author Commented:
Hi

I may have explained this badly (sorry)  ... so I will attempt with pictures:

On our exchaneg server we have the top level - orglevel attached.

When I create a user in the avonvale OU I enter the following command:

New-Mailbox -Name 'Dawn Gilroy' -Alias 'dawn.gilroy' -OrganizationalUnit 'company.co.uk/ExchangeTenants/avonvets' -UserPrincipalName 'bob.smith@avonvets.co.uk' -SamAccountName 'bob.smith' -FirstName 'Bob' -LastName 'Smith' -AddressBookPolicy 'Avonvets'

Then I run:

Set-Mailbox bob.smith@avonvets.co.uk -CustomAttribute1 "Avonvets"

This works perfectly - Bob is in the correct OU and within the Avonvets users and can only see users within Avonvets


I then want to create a group called: "Avoncale Test1", so I run the command:

New-DistributionGroup -Name 'Avonvale test1' -OrganizationalUnit 'company.co.uk/ExchangeTenants/avonvets'

and

Set-DistributionGroup -Identity 'Avonvale Test1' -CustomAttribute1 Avonvets

And this works perfectly .. creates a group that is in the right OU and only members of the Avonvets can see  - attached pic

if I then go into the EMC and into groups .. i see eveything within the org .. which is OK (see attached group layout)

My problem is .. from within the MMC when I want to add users to that group I see everyone within the WHOLE of the organisation /Ous etc...  whereas I only want to be able to select users that are in the avonvale OU  - see attached issue

I hope this has now made sense.


When I run the command as suggested to create a dynamic group:

New-DynamicDistributionGroup -Name "Test11" -IncludedRecipients "AllRecipients" -RecipientContainer "company.co.uk/ExchangeTenants/avonvets" -OrganizationalUnit "company.co.uk/ExchangeTenants/avonvets"

the group does not even show in the users list of groups (avonvets - All Groups) .. see attached mising group


I know I have replaced the co.uk with the word company !!
groups.png
org-layout.png
group-layout.png
issue.png
missing-group.png
0
 
Todd NelsonSystems EngineerCommented:
Let me ask this...

You are needing to restrict the avonvets.co.uk users to only see other users within avonvets.co.uk?

So you need to restrict what they see in their address lists?
0
 
Member_2_7970364Author Commented:
Yes avonvets can only see people within its own GAL ... and this works perfectly.
We have created users in the other companies and they can only see their own companies etc..

The top level company can see everyone - this is fine also

It is just the groups from an administrative point of view ... at the moment the groups I create people can only see them within their own company ...  but ideally the administrator when adding people into the groups should only see the people within that OU
0
 
Jason CrawfordExchange EngineerCommented:
So what you're talking about is the local helpdesk for the tenant in question, correct?  They should have the ability to perform common administrative tasks, like modifying group membership, but no permissions that extent outside their own tenant, correct?  

Assuming this is what you're referring to it sounds like a typical multi-tenant setup, and I've had this exact request myself from one of my tenants.  Just let me know if all this is correct and I'll provide the steps for accomplishing what you're requesting.

On a side note, Dynamic Distribution Groups are great for dynamically adding users to groups based on one or more conditions, but it does nothing to maintain tenant separation.
0
 
Member_2_7970364Author Commented:
Hi Jason

This is is correct ... it merely for the administration
0
 
Jason CrawfordExchange EngineerCommented:
Right I gotcha...basically allowing end-users to manage DGs which they can't do out of the box.  It's actually a lot more involved than I initially thought and involves RBAC roles and managing DGs out of the EAC, not MMC.  If an end-user logs in to the EAC and has the appropriate RBAC roles assigned they will be able to manage DG membership and will only have a view of their own tenant to work with.  

https://blogs.technet.microsoft.com/rmilne/2015/05/27/allow-users-to-manage-distribution-groups-without-creating-new-onesexchange-2013-redux/
0
 
Jason CrawfordExchange EngineerCommented:
On a side note, do you use any kind front end application like Hosting Controller to handle the tenant separation configuration or are you doing everything manually?  I've done it both ways, and I found the additional cost of Hosting Controller well worth it.
0
 
Member_2_7970364Author Commented:
Doing everything manually
In fairness didnt know anything about the hosting controller .. so will look into that
Thanks
0
 
Jason CrawfordExchange EngineerCommented:
No comment has been added to this question in more than 21 days, so it is now classified as abandoned.

I have recommended this question be closed as follows:

Accept: Todd Nelson (https:#a41833713)

If you feel this question should be closed differently, post an objection and the moderators will review all objections and close it as they feel fit. If no one objects, this question will be closed automatically the way described above.

exchangepro
Experts-Exchange Cleanup Volunteer
0
 
Jason CrawfordExchange EngineerCommented:
A dynamic distribution group would not be the solution in a multi-tenant Exchange environment, and I'm not sure how my contribution was ignored as the solution.
0
 
Todd NelsonSystems EngineerCommented:
I agree with Jason.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 5
  • 5
  • 5
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now