GAL Segmentation, Exchange Server 2010 and Address Book Policies
Published Jan 27 2011 09:28 AM 42.3K Views

Update 12/1/11: Several changes have been made to this blog post.

Since the early days of Exchange Server our customers have used various methods to provide different views of the Global Address List (GAL) to subsets of users within the same Exchange Organization. This segmentation allowed administrators to optimize address lists in large companies, creating smaller 'virtual' organizations, with users only able to see the users they need to see. This segmentation still allowed users to share common features in Exchange such as Public Folders, Transport Rules and High Availability constructs.

Historically the method used to provide this segmentation varied between versions of Exchange as the product evolved in design and implementation and until now had not been supported with Exchange 2010.

The Exchange Customer Experience Team has heard the feedback our customers have provided to us and are now working to incorporate a set of features that will provide a Global Address Segmentation capability directly into Service Pack 2, which will be available to customers in the second half of 2011. We plan on posting more about Service Pack 2 in the next couple of weeks.

This decision was taken in order to simplify the deployment and configuration of the feature for all customers by providing a consistent and controlled experience through the standard Exchange management interface.

As a result of the decision to build the functionality into the product, we have also decided that we will not release an updated version of the Configuring Virtual Organizations and Address List Segregation Whitepaper that was published for Exchange Server 2007.

This decision is not one that was taken lightly, but was considered necessary given the scope of the changes that will be introduced into the product with the introduction of the GAL Segmentation feature and the need to provide customers with a clear upgrade path which did not require them to revert a series of previously implemented manual changes.

If you are currently blocked from deploying Exchange 2010 because of a need for this feature in your environment we encourage you to watch for the updated guidance from Microsoft as the feature is developed, then plan your migration accordingly.

In order to provide transparency in these early stages of development, our intentions for this feature are:

  • This feature is not intended to enable the On-Premises configuration of Exchange 2010 to be used in place of the multi-tenant enabled version of the Exchange 2010. (Dec 2011 update) After listening to the feedback we have decided to allow hosters to use the On-Premises configuration of Exchange to host, we announced this here: http://blogs.technet.com/b/exchange/archive/2011/08/30/exchange-server-2010-sp2-and-support-for-host...).
  • Our intended audiences for this feature are organizations that:
    • Require some form of sub-divided address book or who wish to create several 'virtual' organizations within a single Exchange Organization.
    • Enable users to share some resources between these segmented user populations
    • Seek to control which objects are visible to a user when they open their address book picker.

The way we intend to deliver this feature is by using an "Address Book Policy" assignment model, rather than continuing with the ACL based GAL Segmentation concept we previously provided. This approach is not intended to provide complete tenant isolation as is provided in the Hosting mode available in Exchange 2010 SP1, rather it is intended to allow an administrator to grant access to certain views of the GAL rather than restricting views.

If you intend to resell Exchange 2010 mailboxes by using the feature we are introducing, in what is generally recognized as a hosting configuration, we strongly recommend that you (Dec 2011 update) review the following blog post: http://blogs.technet.com/b/exchange/archive/2011/08/30/exchange-server-2010-sp2-and-support-for-host.... Likewise, if you are interested in privately hosting Exchange for the rest of your company, it is strongly advised to consider the limitations and extra requirements associated with the multi-tenant version of Exchange and decide if you truly will need the full functionality or if you only require Address Book Policies.

We hope this announcement will be welcome news to many of our customers and look forward to receiving your comments and announcing more detailed information as we continue to develop the feature.

Kevin Allison
General Manager, Exchange Customer Experience

44 Comments
Not applicable
@Kevin Allison: We wish this would've come sooner. Thanks for planning to make this a feature customers can deploy easily, rather than the manual permissions hacks required earlier.  Exchange team scores again for communicating transparently with customers. Must say you guys are probably the best product team inside Microsoft!
Not applicable
Good to hear this is coming - look forward to further posts fleshing out the details of the new policy module and configuration options!
Not applicable
Long wait on this feature! When the SP2 beta is available publicly?
Not applicable
Great news and better late than never. Of course we all want to know what the migration path from the 2007 whitepaper environment is and how painful it might/will be. Thanks....
Not applicable
This is great news for us.  We try to seperate out teaching staff from our students using multiple ALs for our 18 000 users.

Too bad it took so long but better late than never!
Not applicable
Premise and premises are two different words.
Not applicable
I would hope that we will get documentation that explains how to deploy this in a variety of typologies.  (E2k3) E2k7 ,ETC.
Not applicable
Excellent! Good job listening to customers!
Not applicable
@Charlie - We will be providing documentation to help people who are using 2007 and ACL based segmentation move to ABP's. This is a 2010 feature though, and mailboxes will need to be on 2010 mailbox servers to benefit from ABP's.
Not applicable
Hi Greg, how about those of us Exchange evangelists who enthusiastically migrated our 2007 ALS supported environment to 2010 once RTM was available, months before the announcement that 2010 ALS was not supported?  Hopefully there will be a workable transition (I assume this wouldn't be much different than the changes necessary to migrate a 2007 ALS environment)...  Thanks!
Not applicable
Thank you for listening to our customer feedback ... would be really helpful to let customer know in preparation the pre-requisites to implement SP2 :)
Not applicable
Will SP2 support hosting mode for UM role?
This is a limitation that prevent some customer projects to be implemented.
The segregation is a dificult option since it may not have support of MS
Not applicable
Will there be specific client side requirements for the addessbook exposure
Not applicable
@pesos - you need to get your environment back into a supported state, that would be my advice. We're not going to be testing scenarios we don't currently support. I think it's a bit early to get into specifics on how we will be helping 2007 customers move to ABP's, but you should be prepared for some additional work to get you back to a known state. Sorry.

@Fung and Luis - Watch out for the SP2 information we will be publishing soon. As we said in the post though, using ABP's to try and host Exchange is not the goal of the feature, it will not compare to the true tenanting capabilities available when Exchange is used in /hosting mode.

@Liam - no, there will not be any client side requirements.
Not applicable
Excellent news, you made my day! If the GAL segregation could be achieved using security groups then it would make my week!!!!
Not applicable
Thank you for listening to our customer feedback
Not applicable
please clarify , is there any workaround for exchange 2010 on premise with gal segregration?
Not applicable
No Tayo Dada, there is no supported workaround for Exchange 2010. The only supported solution will be that delivered with SP2.
Not applicable
Regarding that MS decide not to provide a  whitepaper "Configuring Virtual Organizations and Address List " for Exchange 2010 how is the way (or recommendation) for customers who installed a Exchange 2003 resource forest with a manually created addresslist separation (like different virtual org. in one Exchange Org) to upgrade to Exchange 2010 in Mixed Mode.



Not applicable
@Sasha2011 - if you have a resource forest right now, and want to move those mailboxes back in to the the account forest, which would be running 2010 SP2, with the new ABP feature, the path would likely be (and we will be providing guidance for migrating to the feature) to create ABP's that mirror what you have in 2003, then move mailboxes. Once the mailbox is on 2010 it will be subject to the ABP's you have created, and as long as the views you have on both sides of thye system are consistent, the user experience should be consistent. That's the expected behavior at this time.
Not applicable
Of course, hosted mode is missing some key features that make it very unattractive in all but the most rare scenarios.  So I'm surprised to see it mentioned here as a viable option, but then again, I'm continually surprised by the number of options Ex 2010 is missing has compared to earlier versions of Exchange.

For the record, here are some crucial options not supported by Hosting Mode

The Exchange Management Console
Public Folders
Unified Messaging
GAL synchronization
Calendar sharing
Child domains
Discontiguous namespaces
Disjointed namespaces
Not applicable
@JC - I believe that hosting mode really is intended for large-scale hosters that typically have the resources to build custom provisioning tools which make the EMC obsolete.

It is not really usable (nor intended) for smaller-scale needs which will hopefully be well met by this new option in SP2.

I still feel that the timing of the announcements re:2010 were poorly handled, as many of us had already migrated our supported 2007 ALS environments to 2010 LONG before any mention of incompatibility was brought out on Dave's blog.  These environments will hopefully be considered when documentation is provided on "getting back to a supported state" in order to properly migrate to SP2 ABP.
Not applicable
@pesos - we will not be testing with any starting point of unsupported configurations, I'm sorry.

We are sorry the announcement took a long time to come out, it was a complex issue to work through from our side.

You will need to be prepared to thoroughly test your own configuration when the feature comes out and work through your own migration plan - your configuration is unique most likely.

As highlighted in this post, ABP's are not going to allow you to host Exchange in the sense most of us agree on as 'hosting'. Enterprise, or on-prem Exchange, is not the right product for that. If you really want to host Exchange and sell hosted Exchange mailboxes, then you need to use the /hosting version and build a platform with that as the base.
Not applicable
@pesos - your point is well taken, though I think it also reaffirms the fact that hosted mode is not a solid alternative to this missing feature.

Looking forward to trying SP2 with the feature comes out. Cheers.
Not applicable
@Greg Taylor
I wan't to move any mailbox to the account forest or wan't install any exchange 2010 in the res.forest. I tried already install exchange 2010 into the existing exchange 2003 resource forest nearly all seems to work but from a Mapi Client connected to the old ex2k3 mailboxserver i get no GAL and therefore no resolution for any user (OWA no problem! adresslist pointed directly via msexchquerybasedn to the addressbook.The Rights are not changed into 2003 therfore it seems that exchange 2010 is changing something in the GAL Feature...
Not applicable
Correction to my blog above: I wan't to move any mailbox to the account forest or wan't install any exchange 2010 into the account forest.
Not applicable
@Sasha2011
There is a way to "Configuring Virtual Organizations and Address List " for Exchange 2010, its a bit tricky but very much possible. Get in touch with a comapny called "outlook247" and they would give a solution.
I have a setup done by them and all work well on exchange 2010 and now they have upgraded the same to exchange 2010 sp1 also.
Not applicable
@Sasha2011 - Sorry Sasha, I don't quite understand what you are trying to do.

@Winexch - if a customer were to take this approach, we wouldn't be able to support them, so I hope that is clearly understood. If an issue were hit and this was found to be the cause, we would be stuck. Not a good place to be with your email system.
Not applicable
@ Greg Taylor

Yes I am aware of the situation but had no choice other than taking the support of Outlook247, as we have 8 companies and each company GAL should not be visible to other company users. MS did not give us a solution for 3 Months. The solution was good enough and our exchange 2010 holds more than 2300 mailboxes with heavy useage.

I think what Sasha2011 wants is, he currently has  a setup with resource forest with exchange 2003, and has implemented GAL segrigation. Now he wants to transition to exchange 2010, and keep the GAL segrigation the way it was on exchange 2003.

He would have no issues with GAL in Webmail/OWA as it is from "msexchquerybasedn" attribute for the user to populate but when it comes to GAL in MAPI it is from "showInAddressBook"

Thanks

Not applicable
Very good news!
I run a very small hosting company with a service desk that needs its EMC and customers using Public folders so the hosting version is not really an option at this point.
Not applicable
Good News for all,
I s there any new Roll ups for Exchange server 2010 Sp 1  except roll up 2
Not applicable
Good News for all,
I s there any new Roll ups for Exchange server 2010 Sp 1  except roll up 2
Not applicable
Good News for all,
I s there any new Roll ups for Exchange server 2010 Sp 1  except roll up 2
Not applicable
How long should Rollup 2 for Exchange 2010 SP1 take?  I have a 2GHz AMD Opteron 246 with 6GB of memory running Win2008R2 Std.  I've disabled all Exchange services, turned off antivirus, turned off DEP except for core services, set a HOSTS file with crl.microsoft.com set to 127.0.0.1, and turned over CRL revocation checking.  The Rollup has been running for hours with mscorsvw.exe eating 95-100% of the CPU.  Every so often (15 - 20 minutes), mscorsvw.exe errors out and I close it and then it starts back up again.  How long should I expect this to run?  Whenever mscorsvw.exe errors, is it restarting or just continuing on the next .NET assembly?  Any comments would be welcome.  I can be reached at dan@cohnconsultingcorp.com.
Not applicable
Hello Exchange Team,
you wrote: "This approach is not intended to provide complete tenant isolation as is provided in the Hosting mode available in Exchange 2010 SP1..."
Can you explain what exactly the differences are/will be?
Thx!
Not applicable
Hi Marcus, we'll have more details to come, but off the top of my head, /hosting provides admins for tenant orgs with scoping to objects in their own tenant org automatically, they can use remote powershell and only see/change their own objects. That kind of thing isn't anywhere near as easy with on premise Exchange. That's just one example. There are lots of things like this that are much easier with /hosting.
Not applicable
Very good article! thankyou!
Not applicable
I am currently investigating on how to incorporate Exchange 2010 in our soon-to-be multi-tenant hosting environment. We are a relatively small company focusing on the SMB market, and we want to be able to have an answer for people asking for a cloud-based solution.

Exchange 2010 in hosting mode seems to be the most logical option to achieve this, since its truly "multi-tenancy" and allows you to split everything up. The only problem I have with this is the fact that we have limited R&D time to dedicate to this and that there is almost no documentation for Exchange 2010 hosting mode. It's not possible for me to "reverse-engineer" the whole thing... I need something I can refer to.

I've asked this question to an Exchange 2010 MvP and he/she (don't want to name anybody) said to me that even the people at Redmond don't know all that much about Exchange 2010 hosting mode and that it was developed outside the "normal" Exchange team.

She also said for me to wait until SP2 so I could use ALS. As an Exchange developer, I would like to hear your point of view on this. And if you truly are in favor of using Exchange 2010 in hosting mode, could you please point me in the direction of some usable documentation to get started with this?

Thanks a bunch!

Kind regards,
Bart
Not applicable
I would start with this page Bart - http://social.technet.microsoft.com/wiki/contents/articles/exchange-2010-sp1-information-for-hosted-...

And I will certainly clarify that hosting mode Exchange was most certainly not developed outside the regular team, I'm not sure why anyone would think that was the case.
Not applicable

Hi everyone. We are currently running 2010 in non hosted mode. We currently host 5 different companies in this environment with plans to scale to 30-100. As far as we can tell the only limitation is with the gal... Which will be addressed in sp2. The alternative, hosted mode, contains way more gotchas. Why on earth, for our requirements, would I introduce more complexity with less features as suggested by those who say only hosted mode supports true multi-tenant. The companies using our solution will not be larger than 100 users, otherwise we would dedicate an exchange server for them. Am I missing something and there is more risk than I am understanding. I remember when vendors use to say running applications virtual was not supported. Is this a similar situation with multi-tenant "only" being supported in hosted mode.

Not applicable

This will be a great feature. Will you be adjusting the capability of OOF in conjunction with this? So users seperated via Address Book Policies don't receive the "Inside" OOF but the "Outside" one. Thanks...

Not applicable

It is amazing that Microsoft looks at its customers like the Japanese goverment looks at their residents.  Give them only what you want them to hear and hide what is really going on.  In the case of Exchange, it is only fathomable that Microsoft would not include GAL separation capabilites that have been available in all modern Exchange deployments prior to 2010 because they want those types of clients moved to their cloud services.  No other reason would explain the unbridled complexity of doing this along with the loss of so much functionality.  This constitutres abuse by Microsoft towards their customer base.  It is inexcusable behavior but typical of an organization which has lost its way.  As an Exchange 2003 Enterprise user hosting e-mail for many small customers, the move to 2010 is basically impossible and apparently designed this way by Microsoft.  To even produce a new version of Exchange which does not support this (2010 pre SP1) is treachery and then to add it in SP1 with such cripling loss of functionality (no Public Folders, no GUI, no UM, etc.) is disgusting behavior.  Users should be keenly aware that Microsoft is deceiving you in order to hold on to their dwindling market share by forcing small Exchange hosters into cloud services enriching Microsoft while desimating revenues for the small hoster.  To me, it is unconscienable behavior.  I know I cannot be alone in my dissatisfaction with Microsoft on these important issues.

Not applicable

@ Adam Kessler

"As an Exchange 2003 Enterprise user hosting e-mail for many small customers, the move to 2010 is basically impossible "

Hi Adam,

its not impossible at all. I am currently running:

1 2003,2007,2010 mixed exchange org

1 2007,2010 mixed exchange org

1 2010 exchange org

All with segregation!

Not applicable

We have a manual, multi-tenet environment and can not see any benefit in migrating to /hosting.

G/AL Update does make out lives a little easier when creating/deleting users. www.galupdate.co.uk

Version history
Last update:
‎Jul 01 2019 03:57 PM
Updated by: