Hybrid Connector: requirements

The article outlines the prerequisites for setting up CoreView's on-premises services, including hardware specifications for servers, firewall settings, and software versions. It also covers security guidelines and the impact of Multi-Factor Authentication on the system.

Infrastructure requirements

The following requirements apply to the key infrastructure components that support CoreView's on-premises functionality. 

¹ The Hybrid Connector should be installed on a standalone virtual or physical server and not coexist with other business services.

² With Exchange 2013 and later versions, every Exchange Server doubles as a Client Access Server (CAS). You must configure the CoreView Hybrid Connector to target a specific Exchange server rather than a Virtual IP (VIP) address.

³The following versions of VMs on Azure with Windows 2022 are not supported, therefore do not use these versions: https://learn.microsoft.com/en-us/windows-server/get-started/hotpatch 

⁴ Please note that Internet Explorer is not supported.

Multiforest Service Accounts

The structure of the multi-forest version of the CoreView Hybrid Connector echoes that of Microsoft AD Connect. While there will be a single on-premises server hosting the agent, this server needs to be able to reach the chosen domain controller for each forest you aim to integrate.

The connection technology consistently relies on Remoting Powershell (you can find more information in this Microsoft article). Therefore, it's necessary to equip each forest's domain controller with a dedicated service account. This means there's no need for Active Directory Trust or Enterprise Admins.

If a forest has more than one Exchange server, we suggest assigning an additional service account to each extra Exchange organization.

Just like with the single-forest version, we recommend using a domain controller from each forest that has the Global Catalog role assigned. This is because of the requirement to import group members spanning multiple domains and forests. Without a connection to a Global Catalog, these couldn't be imported.

For forests arranged in parent-child relationships, you only need a domain controller from the parent domain. CoreView's data import process can discover each child domain and import the related data.

Network / Firewall requirements

The following requirements apply to network traffic that supports CoreView’s on-premises functionality. Please note that these network requirements pertain only to traffic between the on-premises connector and CoreView or the Microsoft Azure Service Bus infrastructure. 

The CoreView On-premises Connector will also need to communicate with the customer’s Active Directory and, optionally, a select Exchange Server. 

For additional information on the requirements for accessing the Azure Service Bus, please refer to the Microsoft documentation.

Important note about Multi-Factor authentication

If you've enabled Multi-Factor Authentication (MFA) for your Microsoft 365 cloud services, remember to set up a conditional access policy. This policy should exclude your on-premises Hybrid Connector's IP address from requiring a second authentication factor for the CoreView service account named:

4ward365.admin@yourdomain.onmicrosoft.com

Without that exception policy, your CoreView tenant won’t be able to initiate any management sessions.

Keep in mind that your Hybrid Connector's IP address may be subject to Network Address Translation (NAT) by your network gateway when connecting to public networks, like the Internet. We advise consulting with your network specialist to determine the public IP address your on-premises systems use for these connections.

For more information on the conditional access exception policy, please refer to the Microsoft documentation.

Security requirements

The following security requirements apply to CoreView’s on-premises functionality:

(*) Important note about Exchange Virtual Directory configuration:

There are two methods for configuring authentication when setting up the PowerShell Virtual Directory for remote access. If Basic authentication is enabled, SSL must also be enabled and configured with a valid public certificate.  

(**) If your company's security policies restrict granting domain admin permissions to service accounts, please see the section titled Hardening CoreView Hybrid Connector service accounts’ permissions for guidance.

If SSL is not enabled, you should enable Windows Authentication instead. In this case, configure a gMSA for the server hosting the Hybrid Connector and adjust your CoreView Hybrid Connector to support the gMSA configuration.

For more information regarding the configuration of the Exchange Powershell virtual directory, please refer to the Microsoft documentation.

Software requirements

The following software requirements apply to CoreView’s on-premises functionality:

Docker engine installation

For instructions on deploying the Docker service on your hosting server, please consult the Microsoft documentation.