Enable or Disable Federation for Your Organization

Topic Last Modified: 2011-01-27

Support for federation is required to enable users who have an account with a trusted customer or partner organization, including partner domains and users of public instant messaging (IM) provider users that you support, to collaborate with users in your organization. When you have established a trust relationship with such external domains, you can authorize users in those domains to access your deployment and participate in Lync Server communications. This trust relationship is called federation and it is not related to or dependent upon an Active Directory trust relationship.

To support access by users of federated domains, you must enable federation. If you enable federation for your organization, you must also specify whether to implement the following options:

Enable partner domain discovery. If you enable this option, Lync Server 2010 uses Domain Name System (DNS) records to try to discover domains not listed in the allowed domains list, automatically evaluating incoming traffic from discovered federated partners and limiting or blocking that traffic based on trust level, amount of traffic, and administrator settings. If you do not select this option, federated user access is enabled only for users in the domains that you include on the allowed domains list. Whether or not you select this option, you can specify that individual domains to be blocked or allowed, including restricting access to specific servers running the Access Edge service in the federated domain. For details about controlling access by federated domains, see Control Access by Individual Federated Domains.
Send an archiving disclaimer to federated partners to advise them that communications are recorded. If you support archiving of external communications with federated partner domains, you should enable the archiving disclaimer notification to warn partners that their messages are being archived.

If you later want to temporarily or permanently prevent access by users of federated domains, you can disable federation for your organization. Use the procedure in this section to enable or disable federated user access for your organization, including specifying the appropriate federation options to be supported for your organization.

Note:
Enabling federation for your organization only specifies that your servers running the Access Edge service support communications with users of federated domains, including public IM providers. Users in federated domains cannot participate in IM or conferences in your organization until you also configure at least one policy to support federated user access. Users of public IM service providers cannot participate in IM or conferences in your organization until you also configure at least one policy to support public IM connectivity. For details about configuring policies for communication with users of federated domains in other organizations, see Manage Federated Partner User Access in the Deployment documentation or the Operations documentation. Additionally, if you want to support communication with users of IM service providers, you must configure policies to support it and also configure support for the individual service providers that you want to support. For details, see Manage IM Provider Support in the Deployment documentation or the Operations documentation.

Note:

Enabling federation for your organization only specifies that your servers running the Access Edge service support communications with users of federated domains, including public IM providers. Users in federated domains cannot participate in IM or conferences in your organization until you also configure at least one policy to support federated user access. Users of public IM service providers cannot participate in IM or conferences in your organization until you also configure at least one policy to support public IM connectivity. For details about configuring policies for communication with users of federated domains in other organizations, see Manage Federated Partner User Access in the Deployment documentation or the Operations documentation. Additionally, if you want to support communication with users of IM service providers, you must configure policies to support it and also configure support for the individual service providers that you want to support. For details, see Manage IM Provider Support in the Deployment documentation or the Operations documentation.

To enable or disable federated user access for your organization

From a user account that is a member of the RTCUniversalServerAdmins group (or has equivalent user rights), or is assigned to the CsAdministrator role, log on to any computer in your internal deployment.
Open a browser window, and then enter the Admin URL to open the Lync Server Control Panel. For details about the different methods you can use to start Lync Server Control Panel, see Open Lync Server Administrative Tools.
In the left navigation bar, click External User Access, and then click Access Edge Configuration.
On the Access Edge Configuration page, click Global, click Edit, and then click Show details.
In Edit Access Edge Configuration, do one of the following:
- To enable federated user access for your organization, select the Enable communications with federated users check box.
- To disable federated user access for your organization, clear the Enable communications with federated users check box.
If you selected the Enable communications with federated users check box, do the following:
1. If you want to support automatic discovery of partner domains, select the Enable partner domain discovery check box.
2. If your organization supports archiving of external communications, select the Send archiving disclaimer to federated partners check box.
Click Commit.

To enable federated users to collaborate with users in your Lync Server 2010 deployment, you must also configure at least one external access policy to support federated user access. For details, see Manage Federated Partner User Access in the Deployment documentation or the Operations documentation. To control access for specific federated domains, see Control Access by Individual Federated Domains in the Deployment documentation or Operations documentation.