This guide is aimed at system administrators who are capable of connecting to remote systems such as G Suite for Business and Office 365 Admin Panel. GALSync is usually a detailed setup that requires a high level of competence and experience with mail systems and directories.
Although we provide support for our own products, we do not provide support for third-party products such as PowerShell or server administration of Google or Exchange.
If you are concerned you might have any difficulty completing these steps, please consider a solution with our consulting team, contactable via email@example.com. This will ensure a fast, cost-effective and stress-free implementation.
1.2. Using this guide
This guide provides steps for setting up GALSync using the Cloudiway platform, as well as details of any remote system configuration required.
The screen dumps used in this guide reflect these business names to provide typical examples of data to enter into each field.
Whitepapers and guides covering Cloudiway’s other products, such as general mail migration, are available from the Cloudiway website (cloudiway.com).
2.1. What is GALSync?
GALSync stands for Global Address List Synchronization.
The goal of a GAL Synchronization solution is to synchronize users, groups from one source messaging system with contact objects in another messaging system. It allows automatic updates between global address lists to ensure they remain synchronized.
GALSync works between multiple address books through a simple configuration online, which sends pull requests to other address books and pushes the changes to the targets.
How it works:
(1) Pull users & groups from tenant source
(2) Pull target items from tenant target
(3) Push items to target
The GALSync engine is hosted on the Cloudiway platform, it’s a SAAS application. Address books of Cloud messaging systems can be synchronized without requiring to install anything.
2.3. Supported Systems
Note: On-Premises environments require a local agent to be running.
We take your privacy and security seriously at Cloudiway, and we have invested significant effort into making our platform and your data secure. Cloudiway provides a cloud-based application hosted in Windows Azure. It means that the software and data are centrally hosted and accessed by clients using a web browser and internet connection. In addition, Cloudiway’s SaaS benefits from Windows Azure’s certifications, ensuring the security of the infrastructure, network and physical security layers of the Cloudiway cloud.
4.1. Before you start
Before you start, please ensure you have the details outlined in the following table.
|Cloudiway login||Stores details and provides communication between the systems you already use.||https://portal.cloudiway.com|
|Knowledge base access||Our extensive knowledge base is always accessible, with videos, troubleshooting tools, samples and more.||https://kb.cloudiway.com|
4.2. Cloudiway contacts
GALSync setup might require the assistance of our consulting team.
4.3. Service Accounts Creation
This chapter explains how to create the service accounts in order to push (write) data to G Suite, Office 365.
4.3.1. Office 365 Service account
Method 1: Global admin account
The GalSync connector requires an Office 365 tenant admin account.
The reason is that Powershell cmdlets commands are run (PSSession, etc…)
Running these PowerShell commands require to be admin of the tenant.
Method 2: Standard user account
The GALSync O365 service account needs to perform some administrative tasks on your O365 environment to function properly.
The preferred method is to use the Global Administrator role for the GALSync service account. However, there are times when you must set up a service account with limited permissions. It is possible to follow these steps and apply special permissions to the GALSync service account to restrict its access to your tenant.
Warning: This method is not recommended by Cloudiway and is not guaranteed to work in your scenario.
First, you must use a licensed user account. In our tests, we successfully used a dedicated service account with the Business Essentials license.
Second, this account must be able to make PowerShell connections to your tenant. See Microsoft’s current documentation on how to achieve this.
Third, the account must be granted certain roles. To do this:
1. Go to the O365 Exchange Admin Center
2. Select “permissions”
3. Select “admin roles”
4. Create a new role group
5. Give the group a name, description, and set the Write scope to Default
6. Assign these three roles to the role group:
a. Address Lists
b. Mail Recipient Creation
c. Mail Recipients
7. In the Members, area add the licensed service account to the role group
8. Click Save
Once these steps are completed, enter the username and password for this account in your GALSync O365 Target Connector, click save, and click Verify. The verify should complete without errors.
4.3.2. G Suite Service Account
https://apps-apis.google.com/a/feeds/user/, https://apps-apis.google.com/a/feeds/groups/, https://apps-apis.google.com/a/feeds/policies/, https://www.google.com/m8/feeds/, https://apps-apis.google.com/a/feeds/alias/, https://www.googleapis.com/auth/admin.directory.user, https://www.googleapis.com/auth/admin.directory.user.readonly
1. Each scope must be separated by a comma.
2. Some scopes require slashes (/) at the end and others don’t: please use the above strings.
3. If you add another scope later, existing scopes will be removed: you need to add the whole list at the same time.
4.4. Azure Apps Registration
Please refer to this page for Azure Apps registration.
Note: Set the following permissions to the application
User.Read.All, Group.Read.All, Directory.Read.All
4.5. GALSync Setup
The following chapter shows how to setup GalSync between Gsuite, Office 365 and On-Premises environments.
Connectors are multi-directional.
Setup of a connector
Under the Actions section you’ll be able to complete a full synchronization cycle in a four-step process:
Choose your Source and Target connectors and under the Manual Run section click on the action you want to execute.
This action is mainly used to verify if your pulling filter matches your needs as it only gathers data (users and groups) from the selected source.
Each pull is differential: only changes will be saved on our side.
This action first gathers contacts from the selected targets, then displays which changes would be made if you push data to your targets. You can check the simulation results by clicking on any job simulation in the Jobs List then clicking on View Simulation.
To avoid throttling when writing to your tenants, the push first gathers contacts of the target, then push changes.
You can empty our cache if you want. This action cannot be performed when an action is already processing.
(This action could break some links in screens. An automatic process will repair/delete them once a day.)
Switch to the Job List view under the History section to monitor the execution of your tasks, check the status of every job request and the time when they were started and ended.
By clicking on a job in the Jobs List you can see informations concerning the Users, the Groups, and the Contacts, and check what can be the differents possible changes in the target, for example what has been created, modified, deleted or ended in error.
In the Jobs Logs section at the bottom of the Jobs List, you can get further informations about the jobs.
If everything is correct, you are now ready to push the changes.
Select the target connectors and click on Push under the Action section.
Click on Start.
Your GALSync synchronization is now completed.
When everything is up and running, you can schedule the synchronization to run every x hours.
More information in this article, at section 4. Automatic Action.
– Automatic run period: 24 hours.
– Automatic Pull Targets:
o This will ensure that target connectors are pulled at each pass.
o In large environments, Cloudiway might advise you to pull the targets every n passes.
Cloudiway provides an extensive knowledge base with many resources, including common error messages, video guides and downloads.
Please visit the knowledge base here (where you can search for keywords or read through topics): https://kb.cloudiway.com/
The knowledge base also contains information on how you can ask for further support, should you require it.