The Office 365 component parts were first released two years ago. It was an effort to stem the tide of Google Apps and other Web-hosted alternatives to Microsoft’s on-premises and privately hosted Exchange and SharePoint products. They were simplified versions of their perpetually licensed namesakes: designed to run in Microsoft’s Azure cloud service, based on the same core technology, but substantially different in terms of how they were managed and deployed.Today, Microsoft flips the switch on the latest generation of its Office 365 Enterprise hosted collaboration service. At the same time, Microsoft will release for purchase the software products that make up Office 365—Office 2013 Professional, Exchange 2013, SharePoint 2013, and Lync 2013.
Combined with Web versions of Office applications, Office 365 has been both more and less than its Google Apps competition. It blends perfectly with Microsoft’s desktop Office tools and even comes with Office 2013 Pro Plus licenses in its $20-a-month “Plan E3” form. But Office 365’s strengths are less impressive when you look at how it trails Google’s live collaboration and social features. For full disclosure, Ars is an Office 365 shop—but we use Google Docs, GTalk, and a number of other Google Apps tools to fill in gaps we perceive in Office 365.
That may change with the latest incarnation of Office 365 and the Exchange and SharePoint platforms. The differences between Microsoft’s hosted versions of Exchange and SharePoint and the on-premises counterparts have virtually disappeared. Office 365 has gained some real enterprise-strength management features like data loss prevention and e-discovery (at least in its premium plans). And the on-premises versions of the core of Office 365—Exchange Server 2013, SharePoint 2013, and Lync Server 2013 (which will be reviewed separately by Peter Bright)—have all been tweaked for better use in a virtualized world. Regardless of whether you buy a perpetual license and install Exchange and SharePoint on a server in your LAN closet or data center, set up a hosted mail service with a service provider, or subscribe to Office 365 Enterprise, you'll have essentially the same set of administrative tools and the same user and administrative experience.
But perhaps most importantly, the latest versions of the Exchange and SharePoint platforms strike an important balance. The IT department has the power to tightly manage how information flows into, out of, and through an organization, but the platforms also give users the ability to wing it. The new Office 365, Exchange, and SharePoint allows users to collaborate socially, to build ad-hoc solutions, and to self-provision new features and applications through both public and private “app stores” (depending on how much leash the company wants to give them).
We set out to determine just how well the new service and servers strike this balance. We tested on a local installation of Exchange and SharePoint, then used an Office 365 implementation of the same services among Ars colleagues—as well as a known bad actor we’ll call Packetrat, who was out to break the rules.
Exchange 2013 and Exchange Online
There are a number of things Exchange 2013 changes from the user perspective, both for on-premise and in Office 2013. Even if you’re not using Outlook 2013 as your mail client, there are elements of Exchange that will change how you interact with your inbox—even how you think of an inbox.
Most of what users will notice is centered on what shows up in their mailboxes. Now, it’s not just mail. Exchange 2013 and Exchange Online offer more than shared folders and SharePoint integration; there’s a whole new model for in-mailbox applications hosted on the Exchange server.
Which apps show up in Outlook are determined by the Exchange administrator, but there is a growing collection of free and paid applications available through the Office website (directly accessible through the administrative interface). And internal developers can build their own apps for deployment through Exchange as well, adding them either by pulling them in as a file or pointing to their URL. Developers can build mailbox apps using Microsoft’s “Napa” Web-based developer tool for Office 365 and then share its URL to be used on any Exchange server. Once an application is added, it’s available to everyone as an option unless it’s disabled. If desired, apps can be made mandatory as well.
There’s also more integration with SharePoint through a new feature called Site Mailboxes. You can configure a mailbox that’s associated with a specific SharePoint “team page” or other collection within the collaboration server. That mailbox includes an e-mail address that people can send messages to as well as access to the documents in the site’s library. (Those documents are accessible directly from within the Outlook client, though not through Outlook Web Access). Lync Server 2013 also integrates into the Exchange mailbox. It can archive chat sessions in the mailbox store and store Lync contacts there as well.
The other changes in Exchange may be subtler to users, but they’ll be immediately apparent to administrators. If you’re installing Exchange 2013 locally, the first thing administrators will notice is what's gone: the Exchange Management Console and Exchange Control Panel management interfaces. They’ve been replaced by Exchange Administration Center (EAC), a Web-based administrative console shared across all the versions of the Exchange platform. This is the same interface administrators use for Exchange Online, the cloud tenant version offered on its own or as part of Office 365.
There's still support for PowerShell-based administration commandlets (both for on-site and Online versions of Exchange), so automated provisioning and scripted administration of Exchange servers is as powerful, so to speak, as ever. But as far as day-to-day administrative tasks go, it's all done from a browser. This is the case regardless of whether your Exchange server is under your desk, in a rack in your own data center, running as a hosted instance with a service provider, or a tenant in the Office 365 cloud.
EAC also integrates management across both on-premises and hosted services for companies that opt for a “hybrid” Exchange deployment, allowing administrators to move from Enterprise to Office 365 tenant management with a single click in the header.
Another thing missing from the new Exchange is support for older versions of the Outlook client. Exchange 2013 requires its Outlook clients support auto-discovery of the server; this is in part to help streamline cloud deployments of Exchange. Clients also have to support “Outlook Anywhere” access—remote procedure calls via HTTP—to connect to Exchange 2013 instead of using TCP-based RPCs as in older versions of Exchange. In theory, it’s a good thing—unless you have clients still running Outlook 2003.
Those changes are in part because of a major architectural shift in Exchange. Functionality used to be split across multiple server elements to allow for better scaling out of Exchange. Now it's been consolidated into two components: the Mailbox server and the Client Access server. The Mailbox server handles all of the heavy lifting, including the mailbox database, mail transport services, and unified messaging and client access protocols. The Client Access server role, on the other hand, is lightweight. It's intended to act as a proxy and allow for load-balancing of connections. It also handles incoming requests from HTTP, POP, IMAP and SMTP.
The result is that it’s a lot simpler to deploy Exchange in larger organizations. Servers no longer need to have a fully qualified domain name for clients to connect to them; you can have load-balancers pass connections to whichever Client Access server is available. There’s less need for configuring namespaces for different services; whole rafts of Client Access servers can be hidden behind a small number of host names.
EAC might seem like a downgrade for some administrators. There were a number of things you could do from the MMC-based Management Console that you now have to rely on PowerShell to do. But the EAC is an upgrade for those already using Office 365, with more administrative and reporting features exposed. Two of those features are compliance and policy management tools new to Exchange as well. However, they’re exclusive to the Enterprise version of the on-premises server and the enterprise-level plans of Office 365: data loss protection and e-discovery.
Exchange had data retention policies for some time. But the new e-discovery features make it a lot easier to find content in mailboxes—or in Lync instant messages or SharePoint sites—that needs to be held and prevent it from being deleted. All you need is the right query to find it. SharePoint 2013 also has its own e-discovery capability for content not explicitly connected to Exchange.
Exchanges’ e-discovery tools allow for “in-place” preservation of content that matches up with a specific keyword within a group of mailboxes—usually someone working on a specific team requiring regulatory oversight. The e-discovery tool allows any matching e-mail or other messages (including voicemails and other content stored in the Mailbox server) to be retained either indefinitely or for a set period of time based on the needs of the company
A quick test—the tale of Packetrat
Let’s say we’re tracking a project called "Credit Advisory Group." The e-discovery administrator is asked to set up an in-place e-discovery search checking the mailboxes of those involved in the project for the keyword “credit," then holding them for 90 days. You can designate someone as specifically being an e-discovery administrator, or this can be passed off to a legal department if you’ve got one.
Now, the admin previews the results, which are opened in Outlook Web Access. And they discover something unexpected: an employee has been sending e-mails filled with credit card numbers.
Fortunately, another wrinkle in Exchange's new policy enforcement capabilities is data loss prevention. The enterprise versions of Exchange 2013 and Exchange Online come out of the box with a set of templates to enforce compliance with common policies and regulations, such as preventing the leaking of personal identifying information via e-mail. You can also create custom DLP rules based on search strings or common patterns for information and then scale the response from a simple warning that the user can override to completely blocking the message and reporting it to the appropriate person in the company.
These features will make cloud-based e-mail somewhat more palatable for more regulated or secretive companies. There are a few minor setbacks for the truly paranoid, however: Outlook Web Access in Exchange 2013 no longer supports S/MIME encrypted content, for example. But on the whole, there's a lot more security capability out of the box for Exchange (and particularly Exchange Online) in this incarnation of the platform.
SharePoint 2013 and SharePoint Online
SharePoint has been many things to many people over its lifecycle. It started off as sort of a knowledge and document management solution, then picked up aspects of Web server, Wiki, and blogging tools over the past few iterations. Now, Microsoft has turned it into something closer to a social networking tool by adding features that seem plucked from the corporate social networking service Yammer (which Microsoft acquired last summer).
The SharePoint Web service has been given a significant makeover to make it more Windows 8-like, with bright colors and lots of touch-friendly whitespace on its pages. And there are also more ad-hoc collaboration capabilities thrown onto SharePoint for good measure, such as the integration of the OneNote note collecting and organizing application into SharePoint’s “team sites” or the deeper integration with Exchange and Outlook.
Office 2013 also turns SharePoint into a corporate SkyDrive, allowing users to directly synchronize folders from their desktop to a personal storage space on the SharePoint service or to a team document library—or both. The team sites can be used as collaborative file stores by team members like a network file share—except that retention policies can be applied to the contents of the shared SkyDrive-esque folder, and the contents can be searched for e-discovery.
The social features of SharePoint sound like they were lifted from Twitter and Facebook. At the top right corner of every SharePoint page, there are buttons to share and follow it. Sharing allows users to invite others to view or contribute to a page, creating an ad-hoc collaboration around it. Following a page means you get alerts about changes in its status; you can also “follow” people’s activities, specific subject tags, or individual documents. You can even tag pages or documents to associate them with topics; those tags can then be used for search and to drive cross-site publishing of content.
There’s also the Newsfeed app within SharePoint, a “micro-blogging” feature allowing you to post in Twitter-like short format about activities and documents you’re working on. You can broadcast these to everyone via SharePoint’s general Newsfeed page or limit them to a more select audience by posting Newsfeed entries on team pages and other sites within SharePoint set up with the feature. You can also mention other users of the site with an @ in front of their name, and SharePoint alerts them of the mentions.
SharePoint 2010 already had user profile pages and personal home pages. But now the profile pages have taken on a much more Facebook-like nature. Also from the Facebook side of the social metaphor, SharePoint borrowed the concept of “liking.” You can use a like to approve of a comment or answer to a question on a Community site, a new construct in SharePoint that has aspects of a Facebook group page or the Quora question-blogging site. The Community site tracks the level of participation of users, and it allows you to award them badges based on how useful their contributions are.
The big difference, of course, between Community sites and other social media is that companies can apply retention policies to them to ensure they’re in line with corporate governance requirements. And everything in SharePoint can be trolled for e-discovery through SharePoint’s new eDiscovery Center site template, which allows content to be held in place and shared with legal teams through a secured SharePoint site.
The SharePoint Team site has also gotten a tune-up. As mentioned earlier, project sites can be directly integrated into Exchange through a site mailbox; a shared calendar for a project team is also created and automatically added to team members’ Outlook calendar lists. Team sites can be customized with Web "parts" from other site templates, such as the project management lists shown here:
But perhaps the most interesting development tool for ad-hoc app creation related to SharePoint is Access 2013. The database tool, long a favorite of those hoping to end-run around long enterprise app development queues, now offers the ability to publish Web applications to SharePoint and the Azure cloud service. For a small organization looking to create a simple shared database application for a product catalog, project management, or similar non-transactional tasks—and possibly even some transactional ones—the addition of Access app publishing makes SharePoint a much more attractive part of Office 365 for small and midsized businesses.
The Next Generation
There are some eggs broken with this re-imagining of Exchange and SharePoint that some organizations may miss, especially trailing-edge late adopters who still have copies of Outlook 2003 in circulation. And taking full advantage of Exchange and SharePoint 2013 means adopting Office 2013. That’s assumed with the Office 365 full premium plan, since it comes with subscription licenses for the desktop suite as part of its price tag.
As a result, some may hang back a bit longer on older versions of the products. But the changes are a net positive for most organizations, especially smaller ones looking for a way to straddle between the server onsite and cloud services. And while the subscription model of Office 365 may not make a lot of sense for many consumers, it's perfectly logical for small and mid-sized organizations that don’t fit into Microsoft’s volume licensing model.
It’s clear the real mission of Exchange and SharePoint 2013 is to pull Microsoft’s existing customers closer to the cloud precipice, providing them with a smooth path toward either migrating to Office 365 or some other hosting arrangement with the Online products (maybe even creating their own private clouds). When taken in combination with Lync, they reveal Microsoft’s long-term vision of creating a business version of the Outlook.com/SkyDrive/Skype consumer cloud services—offering businesses all the applications and communication they need for a monthly fee per user that isn’t too far removed from their existing phone bill. The goal is turning IT into a utility not far removed from former Sun CEO’ Scott McNealy’s vision of “application dial tone.”
Microsoft is no stranger to the power of bypassing IT—it was a strategy that made the Office platform so dominant in the workplace and then in turn in the consumer market. Tools like Excel, Access, and even Word gave power users the ability to bypass corporate IT to solve problems. This paved the way to world domination for Microsoft’s server platforms—Exchange, SQL Server, and SharePoint—in the process. The problem is that Google and others are moving just as fast, and in some respects have out-Microsofted Microsoft in the game of bypassing IT and following the Pareto principal (delivering 80 percent of the results for 20 percent of the cost). While there’s definitely value in the latest versions of Microsoft’s collaboration platforms, the question is whether they’re worth spending nearly twice as much for.