Problem or Issue Description Changing default calendar permissions. The default permission on a mailbox calendar allows Free/Busy availability to be shown to anyone on the same system who requests it. Recommended Approach It is recommended you change the default permission on a mailbox calendar to not allow the user any access, but to ‘Default’ allow other users within the same tenant to see it. This can be accomplished either with the use of the cmdlet, or by use of a bulk editing tool such as ExFolders. Unsupported Solutions Any method of changing permissions which does not use the built in cmdlets or the ExFolders tool. Additional Comments Mail Enabled Universal Security Groups can be to calendar permission lists, and so your provisioning process should ensure the calendar for any users have only the appropriate permissions applied to only allow access to users from within the same tenant. To avoid issues with converted groups and being unable to use those groups for permissions, it is recommended that you create the group as a mail enabled security group in Exchange. If you create a distribution group and then security-enable it in Windows you may be unable to use it. Problem or Issue Description Creating Organizational Unit hierarchies to support tenants and delegation of administration. Recommended Approach It is recommended that you design and deploy an Organizational Unit hierarchy to enable you to easily manage and segment the tenants you create on the system. If you plan on integrating other applications with Exchange, such as Lync, we recommend you consult that product’s documentation, as they have specific Organizational Unit hierarchy requirements. Be careful of blocking inheritance or removing access to any system accounts, these can cause unexpected results. Rather than extensively manipulate the permissions set on the Organizational Unit hierarchy, aim to use clients that do not see the Organizational Unit structure (any Exchange client using a mailbox on Exchange 2010 uses the Address Book Service and thus ABPs) or search the Active Directory directly. If you are providing access to clients through a Remote Desktop interface, you may also need to enable Active Directory List Object
Problem or Issue Description Changing default calendar permissions. The default permission on a mailbox calendar allows Free/Busy availability to be shown to anyone on the same system who requests it. Recommended Approach It is recommended you change the default permission on a mailbox calendar to not allow the ‘Default’ user any access, but to allow other users within the same tenant to see it. This can be accomplished either with the use of the cmdlet, or by use of a bulk editing tool such as ExFolders. Unsupported Solutions Any method of changing permissions which does not use the built in cmdlets or the ExFolders tool. Additional Comments Mail Enabled Universal Security Groups can be to calendar permission lists, and so your provisioning process should ensure the calendar for any users have only the appropriate permissions applied to only allow access to users from within the same tenant. To avoid issues with converted groups and being unable to use those groups for permissions, it is recommended that you create the group as a mail enabled security group in Exchange. If you create a distribution group and then security-enable it in Windows you may be unable to use it. Problem or Issue Description Creating Organizational Unit hierarchies to support tenants and delegation of administration. Recommended Approach It is recommended that you design and deploy an Organizational Unit hierarchy to enable you to easily manage and segment the tenants you create on the system. If you plan on integrating other applications with Exchange, such as Lync, we recommend you consult that product’s documentation, as they have specific Organizational Unit hierarchy requirements. Be careful of blocking inheritance or removing access to any system accounts, these can cause unexpected results. Rather than extensively manipulate the permissions set on the Organizational Unit hierarchy, aim to use clients that do not see the Organizational Unit structure (any Exchange client using a mailbox on Exchange 2010 uses the Address Book Service and thus ABPs) or search the Active Directory directly. If you are providing access to clients through a Remote Desktop interface, you may also need to enable Active Directory List Object
Multi-Tenancy_and_Hosting_Guidance_For_Exchange_Server_2010_SP2.docx