Enterprise Vault™ Deploying the Office Mail App externally through TMG

Deployment considerations

When publishing Enterprise Vault access through Microsoft Forefront Threat Management Gateway (TMG), it is likely that administrators will only want to configure one external path, rather than presenting multiple externally reachable Enterprise Vault servers. This means that every manifest used to deploy the Enterprise Vault Office Mail App to user mailboxes will have to specify just one URL as the Mail App SourceLocation. The SourceLocation is the location that is used to load the Office Mail App when a user selects it from the App bar in Outlook 2013 or OWA 2013

The Enterprise Vault Setting up Exchange Server Archiving guide explains how this can be achieved using the BaseURL query string parameter for deploying to individual users or to the whole organization using the Exchange PowerShell command New-App.

When the BaseURL parameter is specified in the request to OfficeMailAppManifest.aspx, the generated manifest uses the specified base URL to construct the full SourceLocation path in the manifest. In contrast, when the BaseURL parameter is not specified, the SourceLocation path is based on the Enterprise Vault storage server that archives the mailbox (identified by the LegacyMbxDn query string parameter in the New-App command). This automatically achieves some degree of load balancing, where the Office Mail App only needs to be accessible on the organization's internal network.

For example, to deploy the Office Mail App to a single mailbox so that it can be used externally through TMG, BaseURL is used as follows.

The backtick character (`) is the PowerShell line-continuation character.

$Mbx = get-mailbox "mailbox"

New-App -mailbox $Mbx.LegacyExchangeDN -Url `
  ("http://EV_server/EnterpriseVault/OfficeMailAppManifest.aspx?LegacyMbxDn=" +
  $Mbx.LegacyExchangeDN + "&BaseURL=https://published_server/EnterpriseVault")

Since the SourceLocation in the manifest will be used to load the Office Mail App in Outlook or OWA regardless of the location of the client (internal or external), then a split DNS configuration has to be used. The DNS configuration must ensure that externally published_server will resolve to the TMG.