Introduction

This document explains how to synchronise functional accounts from Microsoft Exchange on-premise or Exchange Online to Zivver using the Zivver Synctool.

It is not recommended to create personal accounts in Zivver for email addresses that are used as shared mailbox. If an email address is shared, make it a functional account in Zivver.

Currently, there are three ways to synchronise functional accounts to Zivver with the Synctool:

1. From Exchange on-premise or Exchange Online.
   Explained in this article.
2. From Active Directory.
   Explained in Synchronising functional accounts from Active Directory.
3. From an Excel file.
   Explained in Synchronising functional accounts from an Excel file.

This manual assumes installation of the Synctool and configuration of the first two tabs is completed.

Technical requirements

The machine on which the Synctool will be installed must meet the following technical requirements:

• The machine has Microsoft .NET 4.7.2 or higher installed.
• The Synctool can make a HTTPS connection (TLS v1.2) on the machine via port 443.

See the sections below for additional requirements based on your organization’s Exchange server type.

Exchange Online additional requirements

• PowerShell module ExchangeOnlineManagement is installed on the Synctool server.
  Install-Module -Name ExchangeOnlineManagement
• Modern Authentication (Certificate-Based Authentication) is used to connect to Exchange Online according to the steps from the Microsoft article App-only authentication for unattended scripts.
• User mailboxes receive delegated access to shared mailboxes via Full Access permissions.

Exchange on-premise additional requirements

• The machine is allowed to make a remote PowerShell connection to the Exchange on-premise server.

• An Exchange account is available which has at least the following rights:

  • Distribution Groups.
  • View Only Configuration.
  • View Only Recipients.

• For shared mailboxes to be synchronised each shared mailbox need to have an email address and delegates with FullAccess permission.

• If FullAccess rights to shared mailboxes are assigned to Active Directory Security Groups, then

  • The Exchange server needs to have Microsoft’s Remote Server Administration Tools installed. Specifically, you’ll need the Active Directory Domain Services (AD DS) and AD Lightweight Directory Services (LDS) tools installed.
  • The Exchange server needs to have the Active Directory PowerShell module installed.

Using Exchange to synchronise functional accounts to Zivver

This section explains how to synchronise functional accounts to Zivver from Exchange on-premise or Exchange Online.

In this manual Exchange on-premise or Exchange Online is the source for the synchronisation. The synchronisation is executed in one direction: from the source to Zivver, not the other way around. You can determine which accounts are synchronised from the source to Zivver with filters.

Synctool tab | Step 3: Set up local users/group settings

In Source to use to sync users with Zivver select Exchange (via Powershell) from the dropdown menu.

Exchange type
Choose the Exchange type you want to use as a source to synchronise functional accounts to Zivver.

• Office 365 - MFA
  

  Only use “Office 365 - MFA” as server type for manual synchronizations. It is not possible to use this for automatic synchronizations, because it requires the admin to enter a MFA when connecting to Exchange Online.

• Office 365 - Certificate

• Exchange on-premise

Set up a connection to Exchange Online manually

Synctool tab | Step 3: Set up local users/group settings

Exchange type
Select Office 365 - MFA.

Admin user name
Fill in the username for the account that can be used to log into Exchange Online. The account must meet the criteria in the technical requirements. The username for Exchange Online is always an email address.

Set up a connection to Exchange Online automictically with certificate

Synctool tab | Step 3: Set up local users/group settings

Exchange type
Select Office 365 - Certificate.

Certificate location
Fill in the location of the .pfx file created at step 3: Generate a self-signed certificate including the name. For example C:\mycert.pfx.

Certificate password
Fill in the password that you used to secure the .pfx file at step 3: Generate a self-signed certificate. Make sure the password is at least 12 characters long and store the password somewhere safe.

Application ID
Fill in the application ID of the App registration created at step 1: Application registration in Entra ID.

1. Go to portal.azure.com.
2. Select Entra ID.
3. Select the tab App registrations.
4. Select the App registration created for the Synctool from the list.
5. Copy the Application (client) ID.

O365 Organization
Fill in the primary domain of you Entra ID tenant. It usually looks like yourcompany.onmicrosoft.com.

1. Go to portal.azure.com.
2. Select Entra ID.
3. Select the tab Overview.
4. Look for the Primary domain on the tenant information tile.

OU to filter on
Optional: You can fill in the Exchange Online OU (not AD OU) to filter on specific units. In most use cases an OU to filter on is not necessary. You can also filter on mailbox types in the next section.

Set up a connection to Exchange on-premise

Synctool tab | Step 3: Set up local users/group settings

Exchange type
Select Exchange on premise.

Exchange address
Fill in the Exchange address. The Synctool will use this address to set up a remote connection.

The address should look like http://"ServerFQDN"/PowerShell/. Replace “ServerFQDN”” with the fully qualified domain name of your Exchange server (for example, exchange01.example.com).

Use Kerberos
Select Yes. Using Kerberos is the default way to authenticate for Exchange on-premise.

Admin user Name
Fill in the username for the account that can be used to log into Exchange. The username often is preceded by the domain - for example company\name_exchange_account.

The account must meet the criteria in the technical requirements.

Password
Enter the password for the Exchange on-premise account.

OU to filter on
Optional: You can fill in the Exchange on-premise (not AD OU) to filter on specific units. In most use cases an OU to filter on is not necessary. You can also filter on mailbox types in the next section.

Select shared mailbox types to include

Synctool tab | Step 3: Set up local users/group settings

At the central column under Shared mailbox types to include you can select the shared mailbox types you want to include in your synchronisation. All shared mailbox types are selected by default.

1. Review which shared mailbox types in your Exchange you want to include in the synchronisation.
   After this step you should know which shared mailbox types in Exchange you want a create functional account in Zivver for.
2. Check the matching boxes for each shared mailbox type in the Synctool.
   This will create a functional account for each shared mailbox type included.
3. Uncheck the shared mailbox types you do not want to include in the synchronisation.
   This will prevent functional accounts from being created for unchecked shared mailbox types.

Assign Zivver OU

1. If your organization uses OU’s in Zivver, then check the box at Assign Zivver OU. If your organization does not use OU’s in Zivver, you can ignore this section.
   

   If your organization uses Organizational Units in Zivver, you have access to the Organization Units tab in Zivver. If you don’t have access, your organization doesn’t use Organizational Units in Zivver, or you don’t have administrator rights.

2. Select the Organization Unit Setup:

   1. If your organization populates Organizational Units in Zivver based on their email domain, then choose Domain name.
   2. If your organization populates Organization Units in Zivver based on a custom OU Identifier, then Choose Custom OU.
      
   You can check the Organizational Unit Identifier by browsing to the Organization Units tab in Zivver, clicking on one of the OU’s present and edit edit the Organizational Unit. You will see the identifier in a popup under Organization Unit Identifier.