#Skype for business mac troubleshooting update#
#Skype for business mac troubleshooting license#

The entire on-premises directory must be synchronized to AAD, and all domains used for logon must be included in the sync configuration.

Federated Identity with AAD with any on-premises STS supported by Office 365.

The following Identity configurations with AAD are supported.

SfBO tenant has been enabled for MA, see here.

Split domain hybrid should be enabled and configured.

Therefore all FE servers need direct Internet access to which will allow them to periodically retrieve the AAD certificate against which they will verify the tokens presented by clients.

The SfB servers need to trust the AAD tokens presented by the clients.

This does not need to be an actual production user of Skype for Business online.

#Skype for business mac troubleshooting license#

One Office 365 tenant user must be assigned a Skype for Business license in order for the service principal for the Skype for Business workload to be created in Azure AD.This needs to completed on all SfB Front End (FE) servers deployed. Since clients can connect from either internal or external web service URLвЂ™s, depending on their network location, both need to be added. The SPNвЂ™s need to be in the format of as this is how the requests will be coming from the clients. Since the clients will be making these requests for authentication using the on-premises web service URLвЂ™s these web service URLвЂ™s need to be configured as Service Principal Names (SPNвЂ™s) for the O365 tenantвЂ™s AAD SfB service application principal. Azure AAD needs to accept authentication requests from SfB clients.For SfB 2013 clients, a registry entry is required > For SfB 2016 clients, this capability will be on by default. SfB clients support Modern Authentication.Set the Oauth configuration to use this server.The SfB server is configured to send authentication requests to Azure AAD.Support for HMA is included in SfB server May 2017 CU5 release, build. Skype for Business Authentication Flow for EWS connectivity It also provides a unified experience and approach to authentication for users across Microsoft Office and can be granularly controlled further with Conditional Access Policies. HMA offers greater security to premises based users by moving authorisation to the Microsoft Cloud but authentication remains on-premises. HMA allows SfBS & Exchange 2013/2016 (Office 2013 +) to leverage AAD security capabilities like two-factor authentication, or Intune Modern Application Management policies. To use HMA with SfB on-premises an on-premises Active Directory federation is required with Azure Active Directory (AAD).

#Skype for business mac troubleshooting update#

Skype for Business Server 20 cumulative update supports Hybrid Modern Authentication (HMA). Hybrid Modern Authentication for Skype for Business Server & Exchange Server 2016Дetailed configuration and troubleshooting steps are covered here and here for enabling HMA for Exchange and Skype for Business respectively.