Office 365 Compliance Edition

Barracuda Cloud Archiving Service

1. Configure Directory Services
2. Launch the Initial Setup Wizard
3. Configure Journaling from Office 365 Mail Service
4. Create and Configure an Office 365 Exchange Online Service Account

Step 1. Configure Directory Services

You must configure LDAP or Azure AD for group expansion and user attributes in the Barracuda Cloud Archiving Service.

Use AD authentication to store and administer Barracuda Cloud Archiving Service user accounts via your organization's LDAP or Azure AD.

When you first set up the Barracuda Cloud Archiving Service, a warning notice displays across the top of the web interface notifying you that you must configure AD through Barracuda Cloud Control and enable groups. Before you continue, you are required to either set up AD and wait for a sync to complete, or select to proceed without AD. Barracuda Networks strongly recommends setting up local AD.

Create a Barracuda Cloud Control Directory

1. Go to Home >  Admin > Directories.
2. Click the Add Directory button. 
   
3. Select one of the following sections to add a new LDAP or Azure active directory.

Add a New LDAP Active Directory

1. Select LDAP Active Directory.
2. On the INFO tab, specify a new Directory Name.

3. Activate the Authentication option to have users authenticate using their LDAP credentials. If you disable this option, users authenticate with Barracuda Cloud Control.

    

   Barracuda Networks strongly recommends creating an additional administrator account using an independent domain that does not use Active Directory (AD) authentication. This allows you access to your Barracuda Networks product account if your AD server goes down or fails.

    

   

4. Click SAVE AND CONTINUE.
5. On the HOST tab, specify the following for the LDAP host:
   • LDAP Host IP address 
   • LDAP Host Port – Use Port 389 for LDAP and LDAPTLS or Port 636 for LDAPS.
   • Base Domain Name (DN) – Any user or group that exists with the search base that will sync to Barracuda Networks. For example, DC=domain,DC=com.
   • Bind DN – Enter the bind domain name for a service account with read permissions to the active directory.
   • Password – Password associated with the service account.
   • Connection Security – Select SSL, TLS, or None. For more information, see New Requirements for LDAP Authentication.
6. (Optional) To add additional servers, click Add LDAP Host.
7. If your LDAP server uses a self-signed certificate, toggle on the Allow Self-Signed Certificate setting.
8. Click TEST CONNECTION to check connectivity to the host. If the connection fails, verify your settings are correct and that you have allowed the Barracuda Networks IP in your firewall. Contact Barracuda Networks Technical Support for additional troubleshooting.
9. If the connection succeeds, it displays as Connected. Click SAVE AND  CONTINUE.
   
10. On the DOMAINS tab, add the domains associated with your users.
11. For each domain that you add, click Verify and following the instructions to verify the domain.
    
12. After each domain is verified, you can sync your users and groups to the Barracuda Cloud Control.

Add a New Azure Active Directory

1. Select Azure Active Directory.
2. On the INFO tab, specify a new Directory Name. For example, "Office 365". 
3. Click CONNECT TO MICROSOFT to sign into Microsoft and authorize Barracuda Cloud Control to connect to your Azure Active Directory account.
   1. Log in with your Office 365 administrator credentials.
   2. Accept the credentials for the application request.

   

4. Activate the Authentication option to have users authenticate using their Azure credentials. If you disable this option, users authenticate with Barracuda Cloud Control.

   Barracuda Networks strongly recommends creating an additional administrator account using an independent domain that does not use Active Directory (AD) authentication. This allows you access to your Barracuda Networks product account if your AD server goes down or fails.

5. After you are redirected back to the Barracuda Cloud Control, click Save.

Back to the Top

Step 2. Launch the Initial Setup Wizard

1. Click Archiver in the left pane. The initial setup wizard will run.

2. Click Next.

3. Click Verify to verify the directory service configuration in your Barracuda Cloud Control account.
   

4. Click Next.

5. Verify that all the email domains you plan to archive are listed here. If there are any missing, add them now.
   
6. Click Next.
7. (Optional) Specify a retention policy. Otherwise, click Next.
   
8. Click Finish to apply your changes.
   

Back to the Top

Step 3. Configure Journaling from Office 365 Mail Service

Option 1. Configure Journaling from the Web Interface

1. Go to the Mail Sources > SMTP Journaling page.
2. Go to Journaling Setup Scripts > Office 365 Setup Script, and click Run Script.
3. Follow the onscreen prompts to configure Office 365 to journal mail to the Barracuda Cloud Archiving Service.

Option 2. Configure Journaling via Script

1. Go to the Mail Sources > SMTP Journaling page.
2. In the Journaling Setup Scripts > Office 365 Setup Script section, click Download to save the PowerShell script to your local system, or click Show Script to copy the script to your clipboard.
3. Open Windows PowerShell, and run the script to configure Office 365 to journal mail to the Barracuda Cloud Archiving Service.

If you are unable to run the journaling script and need to manually configure journaling, see Manually Configure Journaling.

Back to the Top

Step 4. Create and Configure an Office 365 Exchange Online Service Account

Requirements

• Microsoft .NET Framework 4.5 or 4.5.1 and either the Windows Management Framework 3.0 or the Windows Management Framework 4.0.

• An Office 365 global administrator account to apply permissions and scripts.

• Verify the service account has the following:

  • A mailbox with Microsoft Exchange Online Plan 1 or higher.

  • A mailbox that is not hidden in the Global Address list.

  • A license that supports Outlook (i.e., not a kiosk license).

• Enable RPC over HTTP (RoH) for the mailbox. See also How to Enable RPC over HTTP Connectivity.

To import from Exchange Online using EWS, see How to Configure Microsoft Exchange Online Email Import Using EWS. If you are not using EWS, use the following instructions to import from Exchange Online.

Step 1. Connect to Office 365 Exchange Online

1. Install Exchange Online module.
   • If you have already installed Exchange Online module, proceed to the next step.
   • To install Exchange Online module, open Windows PowerShell as an administrator and enter the following command: 
     Install-Module -Name ExchangeOnlineManagement

2. Connect to Exchange Online Powershell and log in with your Office 365 administrator account using the following command:
   Connect-ExchangeOnline

   For more information on connecting to Exchange Online Powershell, see the Microsoft article https://docs.microsoft.com/en-us/powershell/exchange/connect-to-exchange-online-powershell?view=exchange-ps.

3. After you connect to Exchange Online PowerShell, enter the following command:

   Get-Mailbox -ResultSize unlimited | Add-MailboxPermission -User <ServiceAccount@domain.com> -AccessRights fullaccess -InheritanceType all -Automapping $false

    Permissions are assigned on existing mailboxes only; if additional mailboxes are added to your organization, you must rerun this command.

   For more information on adding mailbox permissions, see Add-MailboxPermission in Microsoft TechNet. For information on testing mailbox rights, see Get-MailboxPermission in Microsoft TechNet.

Step 2. Import from Office 365 Exchange Online

To import from Exchange Online using EWS, see How to Configure Microsoft Exchange Online Email Import Using EWS. If you are not using EWS, use the following instructions to import from Exchange Online.

1. Log into the Barracuda Cloud Archiving Service as the admin, and go to Mail Sources > Exchange Integration.

2. Click Start New Action. In the Select Action page, click Email Import.
3. In the Select Server page, click Add New Server.
4. In the Add New Server dialog box, enter a Configuration Name, the email address for the service account and the service account password.
5. Click Autodiscover.

If autodiscover is unable to identify your settings, use the steps in the following section, Manually Configure Settings.

Back to the Top