This document provides guidance on key considerations for deploying Exchange in academic environments, specifically comparing Exchange Online, Outlook Live, and on-premises Exchange Server. It covers areas like client experience, impacts to message flow, data management and security implications, and operational impacts. Exchange Online and Outlook Live offer less flexibility than on-premises Exchange but provide security, maintenance and support benefits through a hosted model. The document aims to help IT professionals evaluate which option best fits their users' needs and their institution.

2. Is there need for internal and external communications?

3. Which clients are important to our users: OWA, Outlook Anywhere with Outlook, MAPI with Outlook, IMAP/POP with 3rd party clients, Mobile Users with Exchange Active Sync and / or with Blackberry Support, Macintosh client support?

4. What are the needs around Single Sign-on for the application?

5. Is email part of a bigger Unified Communications project at your academic institution?

6. Accessibility needs? Web Support When reviewing your customer requirements, it’s important to consider the type of client and web experience that is necessary for your users. Microsoft Outlook Web Access (OWA) is the Internet-based version of Outlook that enables users to access their Exchange mailboxes without the need to install rich client software. The experience will differ based on which service model you consider, as Microsoft is currently are using Exchange 2007 to support on-premises and Exchange Online deployments and Outlook Live is utilizing the next version with Exchange 2010. If you have a large percentage of customers that will be web-based then it’s important to note that Exchange 2007 has the best experience (a premium experience) on Internet Explorer and a Light version for Firefox and Safari. Cross browser / platform support has been highly enhanced in Exchange 2010, and provides a premium Outlook Web Access experience with most Internet Explorer, Firefox, and Safari browsers. Outlook Anywhere Outlook users are provided connectivity to Exchange via MAPI, Outlook Anywhere, or in Exchange 2010 via MAPI with Web Services. The only MAPI connectivity provided in our offerings is via Exchange 2007 on premises. The hosted options provide either Outlook Anywhere (RPC/HTTPS) for Exchange Online, and/or MAPI over web services for Exchange 2010. From an end-user perspective all three options provide excellent connectivity to our premium clients. What’s more important to note here is what clients that are supported across the three email options: Outlook 2002, Outlook 2003, or Outlook 2007. This is important to understand, as it may prompt the need for new installation of clients at your customer site. Exchange Online now supports Outlook 2003 and 2007 with some limits to Outlook 2003 support such as lack of free/busy. Outlook Live utilizes Exchange 2010 servers that only support Outlook 2003 via IMAP (no full connectivity support). The on-premises Exchange 2007 servers can be accessed by Outlook 2002, 2003, and 2007. POP & IMAP Support Internet Message Access Protocol (IMAP) and Post Office Protocol (POP) may be needed or required for your users, based on school supported software. POP and IMAP are supported across all of our services today. Mobility Client experience must also include consideration of mobile device support, Macintosh client support, and Single Sign-On (SSO). All three exchange services provide a powerful mobile device experience for devices that support the Exchange ActiveSync protocol including, but not limited to Windows Mobile, PALM, Nokia, Apple, Helio, RemoSync, DataViz, Samsung, Symbian, and Sony Ericsson mobile devices. For the full list of supported devices please review our mobile website. All three services support ActiveSync, and can provide full mobile device support to the devices listed above. Blackberry devices are supported with Exchange via a Blackberry Enterprise Server (BES) or Blackberry Internet Service (BIS). BIS provides a minimum of email connectivity for on-premises or hosted services and is supported across all three Exchange services. Blackberry Enterprise Server (BES) is available with Exchange On-premises environments, and with our hosted Exchange Online environment (additional licensing and / or pricing requirements may apply). Mac Support Macintosh clients are supported in both our on-premises and hosted service offerings via Exchange Web Service. EWS for Entourage is a new offering that is launching in 2009 to provide increased features and better connectivity to Exchange vs. our current WebDAV support. More information can be found about Entourage with EWS support here. SSO Enabling Single sign-on (SSO) allows a user to log on from their device once to access all resources without signing in again. SSO on premise is the responsibility of Active Directory which can be integrated with existing systems for SSO or reduced SSO. For hosted services the options have two different approaches with Windows Live ID for Outlook Live and a SSO Client for the PC with Exchange Online. Outlook Live leverages the Windows Live Email Portal Integration SDK to allow authenticated Blackborad, Luminis, portal, etc users to access the Live@edu email and collaboration sites without being challenged for their credentials. You can find out more information (including code samples) here. Exchange Online requires a Sign In application which users must sign in to before accessing Exchange Online, in order not to be prompted for their password each time they access the service. As with any extended solution the needs to make a seamless transition from on-premises resources to hosted services is key and Microsoft provides a number of options to assist our customers. ClientExchange OnlineOutlook LiveExchange (on-premises)NotesOutlook Web AccessExchange 2007 client (IE Best Experience)Exchange 2010 client (IE, Firefox, Safari)Exchange 2007 client (IE Best Experience)Outlook AnywhereSupportedSupportedSupportedMAPINot SupportedNot SupportedSupportedBlackberry MobileBIS and BES is supported. BES at an additional cost BIS OnlyBIS and BES is supported. BES at an additional costEntourageEntourage with Exchange Web Services (EWS)Entourage with Exchange Web Services (EWS)WebDAV and Entourage with Exchange Web Services (EWS)SSO ClientSupported via a Sign In Tool Web SSOSupportedUnified MessagingNot SupportedNot SupportedSupported Step 2: Impacts to Message Flow SMTP Relay ServicesConnectors to Other SystemsSMTP Smart HostingTransport RulesLine-of-Business Application IntegrationPublic FoldersMessage Hygiene SMTP Relay Services, SMTP Smart Hosting, Connectors to Other Systems When reviewing the connectivity of hosted services to foreign systems the following options are currently not available either with Outlook Live or Exchange online: SMTP Relay, Smart Hosting, or connectors to other systems. It will be important for you to determine if these features are required or ‘nice to have’ for your institution. Because all three services are built on the power of Exchange, best of breed options are available in other areas that impact Mail Flow. This includes Transport Rules, Line-of-Business (LOB) Integration, and Message Hygiene. Line-of-Business (LOB) Integration Line-of-Business (LOB) applications may include CRM, ERM, or variety of other academic applications. If these applications are in use at your school, they may require integration with the email system. Hosted services provide connectivity with applications via Exchange Web Services (EWS). EWS is an application programming interface that can be used by Simple Object Access Protocol (SOAP) based applications to access Exchange data store items such as inboxes, calendars, and tasks. With on-premises mail these communications can be integrated as well as extended to include other Exchange protocols such as MAPI, IMAP, and POP. Message Hygiene Message hygiene refers to the removal of viruses and unsolicited commercial e-mail from the mail flow before reaching the end user. Anti-virus and anti-spam protections are an integrated part of both the Outlook Live and Exchange Online service. Outlook Live utilizes Hotmail SPAM and Forefront Anti-virus protection for its service. Exchange Online uses our Exchange Hosted Filtering service for SPAM and Virus protection. Both of these capabilities are provided as part of the base offering, at no additional cost. Outlook Live’s message hygiene doesn’t support administrative control but customers have routed mail through their own hygiene filters. Although anti-virus and anti-spam protection is not provided out of the box with Exchange On-premises environments, you can use Microsoft Forefront Online Security for Exchange (FOSE) with you on-premises environment. FOSE provides SPAM and virus protection, disaster recovery, and real-time message trace and reporting. You can also use additional 3rd party options to achieve a similar level of protection for your on-premises environment. Transport Rules With transport rules, administrators and compliance officers can establish and enforce regulatory or corporate policies on internal or outbound e-mail flow or content. For example, rules can be created that would append a disclaimer to any message being sent externally. Rules can also be created to prohibit communication between members of distinct distribution lists or to include the compliance officer on the BCC line any time a specific phrase appears in the subject or content of a message. Exchange on-premises allows the most flexibility and customization of these rules, since they are owned by the customer. Currently, Exchange Online does not provide the ability for customers to extend their experience with transport rules. Outlook Live provides support for a limited set of Transport Rules, customers are limited to the use of three key rules, which include a Bad word filter, setting up a “closed campus” to restrict who your users can send or receive email from, and an Anti-Bullying policy that restricts mail flow between individuals. Additional information about Outlook Live supervision polices, can be found here. One additional point to note, public folders are supported in Exchange On-premises, but are not supported in either Exchange Online or Outlook Live. Exchange OnlineOutlook LiveExchange (on-premises)Transport RulesNot SupportedSupported (Limited)SupportedMessage RelaySupportedPartial, Support Shared Address Space scenario. SupportedSmart HostingNot SupportedNot SupportedSupportedAntispam/AntivirusSupportedSupportedSupportedLOB IntegrationSupported via EWSSupported via EWSSupportedPublic FolderNot SupportedNot SupportedSupported Step 3: Data Management and Security ImplicationsThe need for information security in today's highly networked school environment is more important than ever. Information is arguably one of a school’s most valuable assets, so its protection from accidental exposure or predators from both within and outside the organization is a top IT priority.Network SecurityNetwork security is the safeguarding of electronic information owned by an organization as it is transported across the network, keeping it safe from loss including corruption and ensuring that access is restricted to authorized people and systems. The Exchange Online and Outlook Live environments have detailed security compliance audits which assess the infrastructure in in message hygiene, penetration testing, physical security, as well as intrusion detection. On-premises installations can implement all the security features of our online services but responsibilities as well as testing and maintaining are customer responsibilities. With hosted services these measures are performed on the behalf of the customer.Data IsolationData isolation is the ability to restrict access to data to only those people with the appropriate authorization to read, edit, or delete the data. This is a key topic for most of our customers, when considering whether to keep your information in-house or to host it in the cloud. Security and data isolation is of paramount importance to the Microsoft team. You find out more, by reading the “Microsoft Online Security Features” white paper, which can be found here.It is also important to note that even though we use a multi-tenant model for both Outlook Live and Exchange Online Standard, no school can access the data of another school. Archiving and JournalingArchiving is the ability to keep e-mail for a specific duration of time, and journaling is the ability to automatically create copies of all e-mails sent or received. The Exchange Hosted Archive (EHA) service is available to academic customers at an additional cost, and can be used with the Exchange Online Service and Exchange on-premises environments other 3rd party archiving services can also be used with both environments. Additional information about the Exchange Hosted Archive service can be found here. Journaling is also offered with both Exchange on-premises and Exchange Online offerings, and is provided at no additional cost. Although the Outlook live service supports local archiving to a PST file using an Outlook 2007 client, the service does not provide server-based archiving support (through Exchange Hosted Archive or any other service). Step 4: Ramifications on Business OperationsBefore making any decision on on-premises or hosted services it’s important to examine the ramifications on business operations at your school. . Service ContinuityMessage service continuity is the ability for a school to continue to send and receive email in the event of a failure or component of the infrastructure. Our Exchange online services provide the following resiliency features:Data protection. Multiple copies of customer data are stored within the data center and also remotely at a separate geographic location.Data center redundancy. Microsoft data centers feature the ability to transfer operations to alternative, geographically separate data centers if this becomes necessary. The failover process is managed by Microsoft and requires no intervention from customers when service is resumed.On-premises resiliency is the responsibility of the school implementation. Exchange provides multiple High Availability and Site Resiliency measures to protect the service and the data. Operation and configuration is the sole responsibility of school staff or partner integration. Outlook Live provides no service availability or datacenter redundancy. The service does keep three concurrent copies of the data across three different servers, for fail-over protection. Service Level Agreement (SLA)A service level agreement (SLA) is a written agreement documenting the target percentage of time a service must be available and assigning penalties if it is not. Of the three offerings on-premises, Outlook Live, andExchange Online only Exchange Online offers a 99.9 percent financially backed, guaranteed SLA. On-premisescan have stated SLA’s to provide departments and schools with projected uptime, but this is something that your administrators will control. Outlook Live, by nature of a free service, doesn’t provide any financiallybacked SLA guarantee, but there is a target SLA of 99.99%. If outages are incurred customers are informed and the service is restored in a timely fashion. New ReleasesBoth of our hosted services provide customers with the latest and greatest software. Exchange Online is currently running on Exchange 2007 and will move to Exchange 2010 shortly after Exchange 2010 launches. Customers will have a window of 12 months to move to the next product release in the hosted environment. Outlook Live is running on Exchange 2010 pre-release code and providing academic customers with some great new Exchange 2010 features today. In an on-premises environment, the IT staff has full flexibility on how and when they decide to upgrade to the new environment. The downside of this is that the migration is a customer incurred cost in this scenario. Exchange OnlineOutlook LiveExchange (on-premises)Service ContinuityData and Datacenter resiliencyNot offeredbased on Exchange deployment (CCR, SCR)Service Level Agreement99.9%No based on Exchange operations New Release Rolled into production, 12 month opt inPeriodic updates, running next generation ExchangeRequires upgrade locally and migration. ClientExchange OnlineOutlook LiveExchange (on-premises)Network SecurityFully supportedFully supportedManaged by your On-premises AdministratorsArchivingSupportedNot SupportedSupported, Managed by your On-premises AdministratorsJournalingSupportedNot SupportedSupportedData IsolationSupported SupportedManaged by your On-premises Administrators Step 5: Provisioning and Planning concerns Provisioning, On-boarding, and Directory synchronization are all important aspects when evaluating a messaging solution for your institution. A few questions that are usually raised are: how are they implemented, how can I effectively provide change management, and how is it supported? These are great questions and areas that you should review with your Microsoft team. Our hosted services utilize two different authentication mechanisms today. Outlook Live utilizes Windows Live ID to authenticate and Exchange Online uses Active Directory for authentication. Exchange on-premises utilizes a campus supported Active Directory. Provisioning On-premises Exchange mailboxes can be set for immediate provisioning by using a meta-directory solution such as ILM (Identity Lifecycle Manager) to provision mailboxes after business rules have been met, such as an addition to the human resources database and payroll or after manager approval. Other 3rd party or campus created scripts can be introduced to provision the system but care must be used to also review de-provisioning of the accounts upon separation from the Institution. More info on ILM can be found here. Authentication for Exchange Online requires the use of the SSO client which maintains credentials to automatically login users to Exchange and other BPOS services. Outlook Live utilizes a Windows Live ID to provide authentication and access to its services. Microsoft has worked with customers to develop web Single Sign-on (SSO) options for customers such as the SCT Luminus solution described above. Within the next year, Microsoft will be introducing new and improved methods for accessing cloud services using our next generation of identity management with Geneva. Geneva is a claims-based service that provides federation options for customers to integrate with cloud services in a more seamless option for end-users. The solution will require identities to be authenticated locally the users would be provided tokens to access services in Microsoft’s datacenters using the Microsoft Federation Gateway. The other aspect of provisioning is to provision cloud services with contacts, distribution lists, and email addresses to provide a seamless integration with campus-based services. In Outlook Live this is now provided via GalSync 2010. GalSync 2010 pulls user, contact, partial group and dynamic distribution group data from your on-premises Active Directory and replicates and synchronizes it with your Outlook Live Domain. This is a one-way synchronization with Active Directory to your Outlook Live domain. More information on this can be found here. Exchange Online provisioning is accomplished using the Directory Synchronization Tool. The Directory Synchronization tool is a one-way sync from your local Active Directory environment to Microsoft Online Services. Exchange OnlineOutlook LiveExchange (on-premises)Directory SyncDirectory Sync ToolGalSync 2010Not requiredAuthenticationSSO ClientLive IDActive Directory Step 6: Other Considerations The topics that have been highlighted above, are some of the key considerations that we recommend customers consider when evaluating a new email system. Some of these may be mandatory functional requirements, while others may be nice to have. As noted above, it is important to understand the requirements for your users and institution, and how they may differ by the segment of users you are working with. In addition to the functional and feature differences highlighted above, you may find it valuable to consider some additional overall areas when evaluating the services. One of the most common areas that are overlooked when evaluating a new system is the overall operational cost for managing and maintaining the messaging environment. Although these expenses typically include the cost for headcount to manage the messaging environment, that only captures a fraction of the infrastructure optimization model. Other expenses that should be considered are necessary hardware and software that may be needed to be in place to manage the potential messaging environment, help desk costs to support not only the end users but to also support the environment, etc. Microsoft utilizes the Business Productivity Infrastructure Optimization (BPIO) model to help transform your campus IT from a basic asset that is delivering a service to the school to a dynamic IT environment that is helping achieve the strategic business goals of your organization. By utilizing hosted service, schools can reduce cost and focus IT on the business of schools while providing a world-class service to their customers. In many ways, utilizing services such as Outlook Live can extend your IT by providing 24x7 technical and web support for administrators and help-desk staff. It is important to note though, that while Outlook Live provides phone and web based support for administrators and help-desk staff, end-user support is only provided via the web. Another area that is important in consideration for an email platform is to understand how it fits into your overall integration plans. Exchange on-premises is the only option today that provides integration to LOB applications and integration / extension with Unified Communications. Other important questions can include – does my institution need to integrate Private Branch Exchange (PBX) with Exchange and Office Communication server to deliver voicemail, call control, and / or routing? What is the timeframe to deliver these services and integration? Although our online services environment does not support these options today, there are plans in place to provide unified communications integration to the cloud services including voicemail options for Exchange Online customers. Summary It is important not only to choose the option that’s right for your school today, but the option that will also support your overall academic vision over the next 2 – 5 years and beyond. Across the industry we continue to see increased pressure to provide more value to users while working with a shrinking budget and limited resources. Because of this, the demand for solutions that support the software plus services approach has skyrocketed, particularly for what some customers consider commodity but critical services like messaging and collaboration. While cost is a significant factor in making a decision on the best environment to implement at your school, we can’t stress enough that it should not be the only factor. Although this key considerations guide is not meant to provide an exhaustive list of all the factors that you may want to consider when choosing a messaging service for your institution, it is meant to highlight some of the more common considerations that we’ve seen when working with our customers. Understanding the requirements for your institution is a key step (one that we believe is the most important) to deciding which environment is right for your school. Without understanding end-user and administration requirements, it is almost impossible to make the best decision for your users. This involves an evaluation of what capabilities are ‘required’ versus which ones are ‘nice to have’, and what restraints / challenges are you facing (shrinking budget, limited or eliminated resources, etc.). Please keep in mind that requirements may differ depending on the segment of users you are working with, so finding a solution that allows for flexibility even within the environment may also be important. For example, the capabilities that faculty and staff require usually differ greatly when compared to what’s required by students. This is where the flexibility and the ‘power of choice’ across all of our services provide the best advantage for your environment. Although we’ve compared and contrasted each of the services, it is important to note that you do not have to make an all-inclusive model decision. This means that you can deploy a hybrid model which includes multiple solutions. For example, some of our customers have decided to deploy faculty and staff on Exchange On-premises or Exchange Online, but put their students and alumni in to the Outlook Live service. This approach is advantageous to a lot of our customers because it allows the school to keep all of their users on the same technology platform (so that you can leverage investments you’ve made or will make in Exchange and not have to support two technology platforms), but also reduces costs while increasing capabilities for their users (although there is capital investment made with the On-premises or Exchange Online service, by moving your largest population to the free but highly functional Outlook Live platform you save money). What’s even better, is that you can integrate the two models by providing shared free / busy or GAL synchronization between your on-premises and hosted users! Although it is important to note that this depends on the models you choose to integrate, and what you choose to integrate). This is what we call the hybrid deployment approach, and is becoming increasingly popular among our customers. After all of these considerations have been taken in to account, it is important to thoroughly test the environment that you are interested in; this should not be limited to a few simple test cases, it should include a pilot period with several unique users who represent your broader audience. This will help you test day to day scenarios with your users, to make sure the service will meet your needs. You should also then consider the collaboration and storage implications and integration options across all services. We have created a similar paper to review these services, which can be found here: Although each service offers unique value, capabilities, and benefits, they all are built on our powerful Exchange service technology and offer amazing ways that you can provide extra immediate value to your school. Having scalable, hosted and on-premises Exchange services provides you with multiple options to make the best decision based off of the requirements, integration, and future needs of your school. There is no wrong or irreversible choice, since all three services provide ways for you to make singular or hybrid option decisions, and provide for ways from you to move from one service to another (though you have more migration flexibility with Exchange On-premises and Exchange Online, than you do with Outlook Live today). If you have any questions or comments, please feel free to post your question or feedback, on our education software + services blog, which can be found here: We have also included a guide which provides additional resource information for all three services discussed in this paper. For additional support, please contact your local Microsoft resource. If you do not know who your resource is, please contact our education support team here: ResourceExchange On-premisesExchange OnlineOutlook LiveOverviewExchange Online Service Description Outlook Live Service DescriptionGetting StartedGetting StartedGetting StartedGetting StartedPlanning and ArchitecturePlanning and Architecture Planning and Architecture Planning and Architecture DeploymentDeploymentDeploymentDeploymentOperationsOperations Operations Operations TroubleshootingTroubleshooting Troubleshooting Troubleshooting Security and ProtectionSecurity and ProtectionSecurity and ProtectionSecurity and ProtectionTechnical ReferenceTechnical ReferenceTechnical ReferenceTechnical ReferenceDevelopmentDevelopmentDevelopmentDevelopment