+ 

+ 

+> Association with a hub does not change the permissions on a site. If you associate a site that has restricted access with a hub, only users who have access to the restricted site will see content rolled up on the hub. Information surfaced on the hub site is security trimmed: if you don't have access to the content, you won't see it. Something you may want to consider is adjusting permissions on the associated sites after you have assembled your hub family or [adding a hub "read" permission group to the hub](https://support.microsoft.com/office/set-up-your-sharepoint-hub-site-e2daed64-658c-4462-aeaf-7d1a92eba098#bkmk_managesiteassociationapprovals) and adding that permission group to associated sites.

+- **Should your home site be a hub?** It depends. Consider making your home site a hub if you have a unique set of sites that represent your "official" intranet where you want a distinct brand and search scope that you want to distinguish from other sites in the tenant. Consider leaving your home site as a "regular" site if you plan to have multiple hubs and you want your users to leverage the SharePoint app bar for global navigation. Every site in the intranet does not have to be connected to a hub if your home site is not a hub. Some sites may be part of a hub and have both local and hub navigation but other sites may only have local navigation. In this scenario, your intranet global navigation is provided by the app bar, not a hub.

+- [OneDrive sync reports in the Apps Admin Center](/onedrive/sync-health)

+ 

+ 

+

+This article describes how to plan the capacity of a SharePoint Server 2013 farm. When you have a good appreciation and understanding of capacity planning and management, you can apply your knowledge to system sizing. Sizing is the term used to describe the selection and configuration of appropriate data architecture, logical and physical topology, and hardware for a solution platform. There's a range of capacity management and usage considerations that affect how you should determine the most appropriate hardware and configuration options.

+

+> Some information and values in this article are based on test results and other information related to SharePoint 2010 Products and may not represent the final values for SharePoint Server 2013.

+

+In this article, we describe the steps you should take to undertake effective capacity management for your environment. Each step requires certain information for successful execution, and has a set of deliverables that you'll use in the subsequent step. For each step, these requirements and deliverables are outlined in tables.

+

+

+Modeling your SharePoint Server 2013-based environment begins with analyzing your existing solutions and estimating the expected demand and targets for the deployment you're planning to set up. You start by gathering information about your user base, data requirements, latency and throughput targets, and document the SharePoint Server 2013 features you want to deploy. Use this section to understand what data you should collect, how to collect it, and how it can be used in subsequent steps.

+

+Proper sizing of a SharePoint Server 2013 implementation requires that you study and understand the demand characteristics that your solution is expected to handle. Understanding the demand requires that you'll be able to describe both the workload characteristics such as number of users and the most frequently used operations, and dataset characteristics such as content size and content distribution.

+

+This section can help you understand some specific metrics and parameters you should collect and mechanisms by which they can be collected.

+

+|:--|:--|

+|Average daily RPS <br/> ||

+|Average RPS at peak time <br/> ||

+|Total number of unique users per day <br/> ||

+|Average daily concurrent users <br/> ||

+|Peak concurrent users at peak time <br/> ||

+|Total number of requests per day <br/> ||

+|Expected workload distribution <br/> ||

+|No. of Requests per day <br/>||

+|Web Browser - Search Crawl <br/> ||

+|Web Browser - General Collaboration Interaction <br/> ||

+|Web Browser - Social Interaction <br/> ||

+|Web Browser - General Interaction <br/> ||

+|Web Browser - Office Web Apps <br/> ||

+|Office Clients <br/> ||

+|OneNote Client <br/> ||

+|SharePoint Workspace <br/> ||

+|Outlook RSS Sync <br/> ||

+|Outlook Social Connector <br/> ||

+|Other interactions(Custom Applications/Web services) <br/> ||

+

+- **Concurrent users** - It is most common to measure the concurrency of operations executed on the server farm as the number of distinct users generating requests in a given time frame. The key metrics are the daily average and the concurrent users at peak load.

+

+- **Requests per second (RPS)** - RPS is a commonly used indicator used to describe the demand on the server farm expressed in the number of requests processed by the farm per second, but with no differentiation between the type or size of requests. Every organization's user base generates system load at a rate that is dependent on the organization's unique usage characteristics. For more information, see [Glossary](/previous-versions/office/sharepoint-server-2010/ff758647(v=office.14)#glossary).

+

+- **Total daily requests** - Total daily requests is a good indicator of the overall load the system will need to handle. It is most common to measure all requests except authentication handshake requests (HTTP status 401) over a 24-hour period.

+

+- **Total daily users** - Total users is another key indicator of the overall load the system will need to handle. This measurement is the actual number of unique users in a 24-hour period, not the total number of employees in the organization.

+

+ > The number of total daily users can indicate the growth potential of the load on the farm. For example, if the number of potential users is 100k employees, 15k daily users indicates that the load may significantly grow over time as user adoption increases.

+

+- **Workload Distribution** - Understanding the distribution of the requests based on the client's applications that are interacting with the farm can help predict the expected trend and load changes after migrating to SharePoint Server 2013. As users transition to more recent client versions such as Office 2013, and start using the new capabilities new load patterns, RPS, and total requests are expected to grow. For each client, we can describe the number of distinct users using it in a time frame of a day, and the number of total requests that the client or feature generates on the server.

+

+ For example, the chart below shows a snapshot of a live internal Microsoft environment serving a typical social solution. In this example, you can see that most of the load is generated by the search crawler and typical end-user web browsing. You can also observe that there's significant load introduced by the Outlook Social Connector feature (6.2 percent of the requests).

+

+- Estimate the following items:

+[Deploying SharePoint Server with SQL Server AlwaysOn Availability Groups in Azure](deploying-sharepoint-server-with-sql-server-alwayson-availability-groups-in.md)

+ **Microsoft Azure** - Use Microsoft Azure infrastructure services to create test environments for SharePoint Server 2013 and SharePoint Server 2016. Take advantage of Azure Resource Manager templates for SharePoint and create an environment that you can scale up or down as needed. See [SharePoint 2013 dev/test environments in Azure](sharepoint-2013-dev-test-environments-in-azure.md) and [SharePoint Server in Microsoft Azure](sharepoint-server-in-microsoft-azure.md) for details.

+ Title: "Custom Tiles in SharePoint Server"

+audience: ITPro

+f1.keywords:

+- NOCSH

+ms.localizationpriority: medium

+- IT_Sharepoint_Server

+- IT_Sharepoint_Server_Top

+ms.assetid: 8e7535ee-8a38-4878-aaf3-78b669f4aca8

+description: "This article describes Custom Tiles, which is one of the new features in the November 2016 Public Update for SharePoint Server 2016 (Feature Pack 1)."

+# Custom Tiles in SharePoint Server

+

+In SharePoint Server, users can quickly and easily get to all of their SharePoint and Microsoft 365 workloads directly from the app launcher. Now in addition to those, you can also add your own custom tiles that point to other SharePoint sites, external sites, legacy apps, and more. This makes it easy to find the relevant sites, apps, and resources to do your job

+

+This feature is configured on the web app level by an ITPro administrator by using PowerShell cmdlets.

+

+> [!NOTE]

+> The list for the custom tiles is provisioned at the root level of the web application so anyone will be able to see or remove the list.

+

+## Enable Custom Tiles

+The custom tile feature is not enabled by default. To enable the feature, do these steps.

+

+1. Verify that you have the following memberships:

+

+ - You must have membership in the **securityadmin** fixed server role on the SQL Server instance

+

+ - You must have membership in the **db_owner** fixed database role on all databases that are to be updated.

+

+ - You must be a member of the Administrators group on the server on which you are running the PowerShell cmdlet.

+

+ If these permissions are not satisfied, contact your Setup administrator or SQL Server administrator to request these permissions.

+

+ For more information about PowerShell permissions, see [Permissions](/powershell/sharepoint/sharepoint-server/sharepoint-server-cmdlets?view=sharepoint-ps&preserve-view=true) and [Add-SPShellAdmin](/powershell/module/sharepoint-server/Add-SPShellAdmin?view=sharepoint-ps&preserve-view=true).

+

+2. On the **Start** menu, click **All Programs**

+

+3. Click **Microsoft SharePoint Products**.

+

+4. Click **SharePoint Management Shell**.

+

+5. To ensure the feature is available, at the PowerShell command prompt, type the following command:

+

+ ```powershell

+ Get-SPFeature -Identity CustomTiles

+ ```

+ > [!NOTE]

+ > If the feature is not available, then ensure your SharePoint farm is patched with at least Feature Pack 1 contained in all cumulative updates of SharePoint Server of November 2016 and later. To validate this, you can run the following PowerShell command. Your SharePoint build version should be at 16.0.4456.1004 or later.

+

+ ```powershell

+ (Get-SPFarm).BuildVersion

+ ```

+6. To enable the feature, at the PowerShell command prompt, type the following command:

+

+ ```powershell

+ Enable-SPFeature -Identity CustomTiles -Url http://web_app -Force

+ ```

+ > [!NOTE]

+ > The URL you provide will be the location of where the Custom Tile list is provisioned, so you may need to provide permission access to the list accordingly. Custom Tiles List will be Created on specified URL on feature enable command as hidden list.

+

+7. Since this list is Created as a Hidden List, browse to https://web_app/Lists/Custom%20Tiles/AllItems.aspx to access Custom tiles list.

+

+8. Click **new item** to add a new item to the list.

+

+ :::image type="content" alt-text="Displays dialog to create a new entry for a CustomTile in the November 2016 PU for SharePoint Server 2016." source="../media/6597a87e-cd66-463e-b405-8897926f9c55.jpg" lightbox="../media/6597a87e-cd66-463e-b405-8897926f9c55.jpg":::

+

+9. Enter a **Title** for the new tile. The name will appear in the tile.

+

+10. Enter a number for **Tile Order**. This is the order you want the tile to appear after the default three tiles (that is, Newsfeeds, OneDrive, Sites).

+

+11. Enter a **Url** for the tile. This is the location where you want your users to go when they select the tile.

+

+12. Enter an **IconURL** for the tile. The recommended size for an icon is 50x50 pixels, however the thumbnail will automatically scale. The image appears on the app launcher.

+

+13. Type the name of an **Audience** you want to use this tile. For example, Marketing.

+

+ > [!NOTE]

+ > List or library items in SharePoint Server can be targeted to appear only to people who are members of a particular group or audience. An audience can be identified by using SharePoint groups, distribution lists, or security groups or by using a rules-based system to create a global audience.

+

+After you add a new item in the custom tiles list due to caching, it may take up to 24 hours before you can see it appear in the app launcher. If you want to see it immediately, you can run **ClearSuiteLinksCache()** function in the developer browser's console that is displayed by pressing **F12** while in a browser session as displayed in the following diagram.

+ > [!NOTE]

+ > The **ClearSuiteLinksCache()** function is not available for modern sites in SharePoint Server 2019 and will generate an error if used.

+

+ :::image type="content" alt-text="Displays the developer browser's console in a browser session." source="../media/313b5ce5-07df-4fd3-8861-59d3c7635970.jpg":::

+

+After the **ClearSuiteLinksCache()** function is run, it returns "undefined".

+

+

+You must refresh the page by pressing **F5** or the refresh button  on the Address bar of your browser for the tile to now appear in the app launcher.

+

+## Enable Custom Tiles across multiple web applications

+If you want to use the same list of custom tiles across multiple web applications, enable the feature on each web application, and then update the web application property **CustomTilesListHostUrl** to the web application that contains the desired custom tiles list. To do this, follow these steps:

+

+1. Verify that you have the following memberships:

+

+ - You must have membership in the **securityadmin** fixed server role on the SQL Server instance

+

+ - You must have membership in the **db_owner** fixed database role on all databases that are to be updated.

+

+ - You must be a member of the Administrators group on the server on which you are running the PowerShell cmdlet.

+

+ If these permissions are not satisfied, contact your Setup administrator or SQL Server administrator to request these permissions.

+

+ For more information about PowerShell permissions, see [Permissions](/powershell/sharepoint/sharepoint-server/sharepoint-server-cmdlets?view=sharepoint-ps&preserve-view=true) and [Add-SPShellAdmin](/powershell/module/sharepoint-server/Add-SPShellAdmin?view=sharepoint-ps&preserve-view=true).

+

+2. On the **Start** menu, click **All Programs**

+

+3. Click **Microsoft SharePoint Products**.

+

+4. Click **SharePoint Management Shell**.

+

+5. To ensure the feature is available, at the PowerShell command prompt, type the following commands:

+

+ ```powershell

+ $w = Get-SPWebApplication http://web_app

+ $w.Properties.CustomTilesListHostUrl = "http://web_app url"

+ $w.Update()

+ ```

+If you want to unhide list of custom tiles, you can do this by using PowerShell.

+

+From a PowerShell command prompt, type the following commands:

+

+```powershell

+$web = get-spweb "http://web_app"

+$list = $web.Lists["Custom Tiles"]

+$list.hidden = $false

+$list.update()

+```

+> [!NOTE]

+> The List will be visible when site Contents is viewed.

+

+To add this list to Left Navigation pane, do the following steps:

+

+1. Browse to List settings.

+

+2. Click on **List** name, description, and navigation.

+

+3. Select **Yes** for Navigation setting to display list on **Quick Launch** as displayed with this image.

+

+ :::image type="content" alt-text="Displays Quick Launch settings." source="../media/22b5e6e8-37c1-4120-9c89-456d06867a6e.jpg":::

+

+ Title: "Deploying SharePoint Server with SQL Server AlwaysOn Availability Groups in Azure"

+audience: ITPro

+f1.keywords:

+- CSH

+ms.localizationpriority: medium

+- Ent_O365

+- IT_Sharepoint_Server

+- IT_Sharepoint_Server_Top

+- Strat_O365_Enterprise

+- Ent_Solutions

+ms.assetid: af7cf3e7-94b1-4a5d-8cb9-80c5a0b397f2

+description: "Get an overview of deploying SharePoint Server in Microsoft Azure with links to each phase of the deployment."

+# Deploying SharePoint Server with SQL Server AlwaysOn Availability Groups in Azure

+

+Step through the deployment an intranet-only, high availability SharePoint Server farm in Azure with these virtual machines:

+

+- Two SharePoint front end and distributed cache servers

+

+- Two SharePoint application and search servers

+

+- One cluster majority node server

+

+- Two domain controllers

+

+Here is the configuration, with placeholder names for each server.

+

+**An intranet-only, high availability SharePoint Server farm in Azure**

+

+

+Two virtual machines for each role ensure high availability. All of the virtual machines are in a single cross-premises Azure virtual network. Each group of virtual machines for a specific role is in its own subnet and availability set.

+

+> [!NOTE]

+> Because this VNet is connected to the on-premises network, this configuration does not include jumpbox or monitoring virtual machines on a management subnet. For more information, see [Running Windows VMs for an N-tier architecture](/azure/architecture/reference-architectures/n-tier/n-tier-sql-server).

+

+## Bill of materials

+This baseline configuration requires the following set of Azure services and components:

+

+- Nine virtual machines.

+

+- Four availability sets.

+

+- One cross-premises virtual network with five subnets.

+

+- One Azure subscription.

+

+Here are the virtual machines and their default sizes for this configuration.

+

+|**Item**|**Virtual machine description**|**Gallery image**|**Default size**|

+|:--|:--|:--|:--|

+|1. <br/> |First domain controller <br/> |Windows Server 2016 Datacenter <br/> |D2 <br/> |

+|2. <br/> |Second domain controller <br/> |Windows Server 2016 Datacenter <br/> |D2 <br/> |

+|3. <br/> |First database server <br/> |Microsoft SQL Server 2016 Enterprise - Windows Server 2016 <br/> |DS4 <br/> |

+|4. <br/> |Second database server <br/> |Microsoft SQL Server 2016 Enterprise - Windows Server 2016 <br/> |DS4 <br/> |

+|5. <br/> |Majority node for the cluster <br/> |Windows Server 2016 Datacenter <br/> |D2 <br/> |

+|6. <br/> |First SharePoint application and search server <br/> |Microsoft SharePoint Server 2016 Trial - Windows Server 2012 R2 <br/> |DS4 <br/> |

+|7. <br/> |Second SharePoint application and search server <br/> |Microsoft SharePoint Server 2016 Trial - Windows Server 2012 R2 <br/> |DS4 <br/> |

+|8. <br/> |First SharePoint front end and distributed cache server <br/> |Microsoft SharePoint Server 2016 Trial - Windows Server 2012 R2 <br/> |DS4 <br/> |

+|9. <br/> |Second SharePoint front end and distributed cache server <br/> |Microsoft SharePoint Server 2016 Trial - Windows Server 2012 R2 <br/> |DS4 <br/> |

+

+To compute the estimated costs for this configuration, see the [Azure pricing calculator](https://azure.microsoft.com/pricing/calculator/).

+

+> [!NOTE]

+> The Azure Pricing Calculator does not include the additional costs for the SQL Server license for the two virtual machines running SQL Server 2016 Enterprise. See [Virtual Machines Pricing-SQL](https://azure.microsoft.com/pricing/details/virtual-machines/#Sql) for more information.

+

+## Phases of deployment

+You deploy this SharePoint Server farm with the following phases:

+

+- [SharePoint Intranet Farm in Azure Phase 1: Configure Azure](./sharepoint-intranet-farm-in-azure-phase-1-configure-azure.md)

+

+ Create resource groups, availability sets, and a cross-premises virtual network.

+

+- [SharePoint Intranet Farm in Azure Phase 2: Configure domain controllers](./sharepoint-intranet-farm-in-azure-phase-2-configure-domain-controllers.md)

+

+ Create and configure replica Windows Server Active Directory (AD) domain controllers

+

+ > [!NOTE]

+ > SharePoint Server also supports the use of [Azure Active Directory (AD) Domain Services](/azure/active-directory-domain-services/active-directory-ds-overview) as a substitute for virtual machines running as domain replicas. However, at this time, this deployment guide only describes the use of virtual machine-based replica domain controllers.

+

+- [SharePoint Intranet Farm in Azure Phase 3: Configure SQL Server Infrastructure](./sharepoint-intranet-farm-in-azure-phase-3-configure-sql-server-infrastructure.md)

+

+ Create and configure the SQL Server virtual machines, prepare them for use with SharePoint, and create the cluster.

+

+- [SharePoint Intranet Farm in Azure Phase 4: Configure SharePoint servers](./sharepoint-intranet-farm-in-azure-phase-4-configure-sharepoint-servers.md)

+

+ Create and configure the four SharePoint server virtual machines.

+

+- [SharePoint Intranet Farm in Azure Phase 5: Create the availability group and add the SharePoint databases](./sharepoint-intranet-farm-in-azure-phase-5-create-the-availability-group-and-add.md)

+

+ Prepare databases and create a SQL Server AlwaysOn availability group.

+

+This configuration is a prescriptive, phase-by-phase guide for a predefined architecture to create a highly available intranet SharePoint Server farm in Azure infrastructure services. Keep the following in mind:

+

+- If you are an experienced SharePoint implementer, feel free to adapt the instructions in phases 3 through 5 and build the farm that best suits your needs.

+

+- If you already have an existing Azure hybrid cloud deployment, feel free to adapt or skip the instructions in phases 1 and 2 and host the new SharePoint farm on the appropriate set of subnets.

+

+To build a dev/test environment or a proof-of-concept of this configuration, see [Intranet SharePoint Server in Azure dev/test environment](intranet-sharepoint-server-in-azure-dev-test-environment.md).

+

+## Next step

+Start the configuration with [SharePoint Intranet Farm in Azure Phase 1: Configure Azure](./sharepoint-intranet-farm-in-azure-phase-1-configure-azure.md).

+

+## See also

+#### Concepts

+[Install SharePoint Server](../install/install.md)

+#### Other Resources

+[SharePoint Server in Microsoft Azure](sharepoint-server-in-microsoft-azure.md)

+

+[Designing a SharePoint Server farm in Azure](designing-a-sharepoint-server-farm-in-azure.md)

+ Title: "Deployment considerations for implementing Microsoft Identity Manager with SharePoint Server"

+# Deployment considerations for implementing Microsoft Identity Manager with SharePoint Server

+Proper setup of the MIM Synchronization Service in your test lab and careful planning of your migration from test lab to production is essential to minimizing deployment problems. It's recommended you use a small test environment, to avoid processing thousands of objects when you test new rules.

+Regular backup procedures are essential for protecting your data from accidental loss. It's also recommended that you test your backup and restore procedures before an emergency occurs. To back up and restore MIM, use the backup tools provided with Windows Server 2012 R2 operating system and SQL Server 2014.

+During MIM Synchronization Setup, the remote database access depends on the access rights of the current logon account that you're using to run Setup. Ensure that the server running Windows Server 2012 R2 operating system that hosts MIM and the server that hosts SQL Server are in the same domain and that the account that you're using to run Setup has access rights to the server that hosts SQL Server.

+> If you install SQL Server on a remote computer and allow network access to the remote computer, you'll receive a security warning from MIM setup. For this scenario, the warning can be ignored.

+After you use Export Management Agent, you can then use the **Import Management Agent** command to import a specific version of the individual management agent. You can also export and import management agents by using the **Export Server Configuration** and **Import Server Configuration** commands, but doing so imports all management agents in addition to the metaverse schema. For more information on how to configure and import, see [Configuring Management Agents](/previous-versions/mim/jj590191(v=ws.10)) and [Importing and Exporting a Server Configuration](/previous-versions/mim/jj590279(v=ws.10))

+When listing objects by using Metaverse Search, MIM returns results identified by the **displayName** attribute. If the **displayName** attribute is not populated, the search results are identified by the globally unique identifier (GUID). For more information on how to use metaverse search, see [Using Metaverse Search](/previous-versions/mim/jj572785(v=ws.10))

+When you deploy MIM for the first time, it's recommended you migrate and join all connected data sources before you enable provisioning. After you've verified that everything has been successfully migrated and joined, you can enable provisioning and run a Full Synchronization of the management agents to apply the provisioning rules to all connected objects. For more information on how to configure provisioning rules, see [Provisioning Rules](/previous-versions/mim/jj590298(v=ws.10))

+Use the deletion threshold setting to limit the number of accidental deletions that can occur during import or export. The deletion threshold will stop the management agent, or prevent it from starting, when the threshold limit is reached. For more information, see [Configuring Management Agents](/previous-versions/mim/jj590191(v=ws.10)).

+With Search Connector Space, you can search for objects in the connector space for a management agent. You can locate objects by name or error status, or by the state of the object (that is, whether it's connected, disconnected, or waiting to be imported or exported).

+Objects that fail to join are not reevaluated by the Delta Import and Delta Synchronization run profile step and might remain as disconnectors. Running a Delta Synchronization step on a regular basis will reevaluates and processes these disconnectors. For more information on how to run profile steps, see [Configuring Management Agents](/previous-versions/mim/jj590191(v=ws.10)).

+Operations records a history of every management agent run. Each management agent run history is saved in the SQL Server database, and can cause the database to grow over time, affecting performance. The run history can be saved using Operations. For more information on how to use Operations, see [Using Operations](/previous-versions/mim/jj590289(v=ws.10)).

+> Deleting very large numbers of runs at once make take considerable time. It's recommended you delete no more than 100 runs at a time.

+To control synchronization of single object types in a file-based management agent, create a partition for each object type. For example, to synchronize the object types **mailbox** and **group**, create two partitions in the management agent, and assign **mailbox** to one partition and **group** to the other. Then, create a management agent run profile for each partition. With this configuration, you've one management agent with the flexibility to synchronize one or both of the selected object types. For more information on how to use partitions, see [The Metaverse and the Connector Space](/previous-versions/mim/jj590171(v=ws.10))

+Performance can be negatively impacted if all the databases in the system are created with a smaller size and set to auto-grow especially by small increments. A minimum of 16 GB of RAM for the SQL Servers is required but you'll benefit from more memory. You should have at least 16 CPU cores on the SQL servers but more cores will help overall performance.

+Finally, it's recommended not to run MIM and SharePoint databases together on the same server.

+If you switch from one synchronization type to another by using the **Configure Synchronization Settings** in the SharePoint Central Administration website, you'll experience issues with no objects being returned when an import on the SharePoint Connector instance is started, and no results in the ULS logs.

+New user profile properties can be created in SharePoint Servers; however, the mappings are not created in SharePoint, but within MIM.

+As synchronization will often include personally identifiable information, it's recommended the sync runs are performed over a secure channel such as HTTPS or LDAPS.

+[Overview of Microsoft Identity Manager Synchronization Service in SharePoint Server](overview-of-microsoft-identity-manager-synchronization-service-in-sharepoint-ser.md#overview-of-microsoft-identity-manager-synchronization-service-in-sharepoint-server)

+ Title: "Designing a SharePoint Server farm in Azure"

+audience: ITPro

+f1.keywords:

+- CSH

+ms.localizationpriority: medium

+- Ent_O365

+- IT_Sharepoint_Server

+- IT_Sharepoint_Server_Top

+ms.assetid: f27522ca-6f78-4b97-b169-77066e965727

+description: "Step through a process to design Microsoft Azure infrastructure services to host SharePoint Server farms."

+# Designing a SharePoint Server farm in Azure

+

+This article provides an overview of the support for SharePoint Server farms in Azure infrastructure services and a step-by-step process and recommendations and best practices for designing the Azure environment, including network, storage, and compute resources.

+

+## SharePoint Server farms in Azure infrastructure services

+Running SharePoint Server farms in any Infrastructure as a Service (IaaS) environment can take advantage of the following:

+

+- Capacity on demand and the ability to scale virtual machines up (elasticity)

+

+- Partial outsourcing

+

+- Additional locations with minimal investment

+

+- Cost savings

+

+Here are the scenarios in which SharePoint farms should be run from an IaaS environment:

+

+- Dev/test, pilot, or proof-of-concept farm

+

+- Hybrid infrastructure

+

+- Disaster recovery

+

+- Production farm

+

+### Supportability of SharePoint Server in Azure

+Microsoft supports the following SharePoint Server deployment scenarios on Azure IaaS virtual machines (VMs):

+

+- Non-production farms, such as those used for dev/test environments or for proof-of-concept

+

+- As a disaster recovery target using log shipping, SQL Server AlwaysOn Availability Groups, or Azure Site Recovery

+

+- Production farms, using Azure premium storage for servers running the search role

+

+Production farms running SharePoint 2013 are also supported. SharePoint 2010 is no longer in mainstream support, however it can be installed on Azure VMs for testing and validation of migration scenarios.

+

+As with other Microsoft workloads, licensing is handled with Licensing Mobility through Software Assurance. For more information, see [Licensing Microsoft server products for use in virtual environments](https://download.microsoft.com/download/3/d/4/3d42bdc2-6725-4b29-b75a-a5b04179958b/microsoftservervirtualization_licensemobility_vlbrief.pdf).

+

+## The design process for SharePoint Server farms in Azure

+The Azure infrastructure services environment is different than on-premises data centers and requires additional planning. The following design process steps you through determining the following elements of Azure infrastructure:

+

+1. Resource groups

+

+2. Connectivity

+

+3. Storage

+

+4. Identity

+

+5. Security

+

+6. Virtual machines

+

+Each step includes best practices and recommendations specific to the requirements of SharePoint Server farms.

+

+At the end of the design process, you will have determined the set of components in Azure infrastructure services that is ready for your SharePoint Server farm.

+

+> [!TIP]

+> This process is based on [Design Azure infrastructure services to host a multi-tier LOB application](/archive/blogs/solutions_advisory_board/design-azure-infrastructure-services-to-host-a-multi-tier-lob-application).

+

+### Step 1: Resource groups

+Resource groups are containers for multiple Azure elements that can be managed together. For example, you can create access control lists that allow only specific user accounts to modify the set of elements in a resource group.

+

+You can place all of the resources for your SharePoint Server farm in the same resource group, but this is highly discouraged for production deployments. Instead, the recommendation is to use different resource groups for:

+

+- Infrastructure and networking components

+

+ For example, a resource group called Networking_RG that contains the virtual network (VNet), network security groups, and load balancers.

+

+- The separate roles of the SharePoint farm

+

+ For example, use separate resource groups for the front-end, search, application, distributed cache, data, and combined roles of a typical SharePoint Server farm. In each separate resource group, place the availability sets, network interfaces, and virtual machines of that role.

+

+For your resource groups, fill in the following table before creating them, using as many rows as needed.

+

+|**Resource group name**|**Azure location (region)**|

+|:--|:--|

+|||

+|||

+

+### Step 2: Connectivity

+Connectivity includes:

+

+- Access to the servers running in your SharePoint Server farm, both for administration and for the resources of the farm, from your intranet and the Internet.

+

+- Access for the servers of the farm to each other, to the intranet, and to the Internet.

+

+The elements of connectivity include virtual networks (VNets), the subnets within VNets, Domain Name System (DNS) for name registration and resolution, traffic distribution, and addressing for virtual machines.

+

+#### VNets

+The required container for virtual machines in Azure infrastructure services is the Azure VNet. There are two types of VNets:

+

+- Cloud-only

+

+ Has no connection to an on-premises network. Use this type of VNet when you are deploying an Internet-facing SharePoint farm that uses a standalone Windows Server Active Directory (AD) forest.

+

+- Cross-premises

+

+ Has a connection to an on-premises network and must be assigned a unique address space from your intranet. Use this type of VNet when you are deploying an intranet-based SharePoint farm that uses an on-premises Windows Server AD forest.

+

+Although it is possible to place the VMs of a server role of a SharePoint farm in different VNets, this is highly discouraged because network traffic between VMs would have to travel across a VNet-to-VNet or VNet peering connection. The recommendation is to place all of the servers of a farm in a single VNet.

+

+When you create the VNet, you must assign an address space to it, which can consist of one or multiple Classless Inter-Domain Routing (CIDR) blocks (also known as network prefixes). This is similar to assigning an address space to a new datacenter that will contain multiple subnets and IT workloads. The address space you choose depends on the type of VNet:

+

+- Cloud-only

+

+ Can have any address space from the private IPv4 address space (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), if it does not overlap with the address spaces of other interconnected VNets.

+

+- Cross-premises

+

+ Must be a unique, non-overlapping address space from your intranet address space, which can include public and private address spaces.

+

+For your VNet, fill in the following table.

+

+|**VNet name**|**VNet type**|**Resource group name**|**Address space**|

+|:--|:--|:--|:--|

+|||||

+

+ Place the VNet in the resource group for infrastructure or networking components.

+

+Note that you can use an existing VNet that hosts IT workloads on virtual machines in Azure or you can create a new VNet.

+

+#### Subnets

+Just like the subnets in your datacenter, subnets of an Azure VNet are logical divisions of the IPv4 address space to group and separate network nodes and their traffic. Azure supports three types of subnets:

+

+- VM-hosting (required)

+

+ Hosts the VMs of an IT workload. An example is all of the servers running the distributed cache service of a SharePoint Server farm.

+

+- Gateway

+

+ Hosts the Azure gateways for a cross-premises or VNet-to-VNet VPN connection. This subnet must be named "GatewaySubnet".

+

+- Management (recommended)

+

+ Hosts two or more VMs that provide remote desktop connections to the servers in the VNet and support network management functions.

+

+Just like your on-premises datacenters, the recommendation in Azure is to use a separate VM-hosting subnet for each set or VMs providing the same server role for your farm. With separate subnets, you can use Azure network security groups to define the allowed inbound and outbound traffic and perform subnet isolation.

+

+The address space for each subnet must be a portion of the VNet address space expressed as a single CIDR block, also known as a network prefix. Choose enough address space to accommodate the projected set of servers running that common server role.

+

+|**Number of servers**|**Length of the network prefix**|

+|:--|:--|

+|1-3 <br/> |/29 <br/> |

+|4-11 <br/> |/28 <br/> |

+|12-27 <br/> |/27 <br/> |

+|18-59 <br/> |/26 <br/> |

+

+The recommendation for the GatewaySubnet is to use a /27 network prefix length and assign it from the last part of the VNet address space. For more information, see [Calculating the gateway subnet address space for Azure virtual networks](/archive/blogs/solutions_advisory_board/calculating-the-gateway-subnet-address-space-for-azure-virtual-networks).

+

+For the subnets of your VNet, fill in the following table before creating them, using as many rows as needed.

+

+|**Subnet name**|**Address space**|

+|:--|:--|

+|GatewaySubnet (if needed) ||

+|||

+|||

+|||

+

+#### DNS

+All VMs in an Azure VNet by default are assigned a set of DNS servers to perform name registration and resolution. You can override this by assigning DNS servers to individual VM network interfaces.

+

+For a SharePoint Server farm in Azure that uses [Azure Active Directory (AD) Domain Services](/azure/active-directory-domain-services/active-directory-ds-overview), assign the IP addresses of the service as the DNS servers.

+

+For a SharePoint Server farm in Azure that contains a set of Windows Server AD domain controllers that are also acting as DNS servers, assign the IP addresses of the domain controllers as the DNS servers. For a cross-premises VNet, you need two sets of DNS servers:

+

+- A set of DNS servers on your on-premises network that your domain controller VMs use when they join the domain and are promoted to domain controllers.

+

+- After the VMs have become DNS servers, you reset the DNS servers to the IP addresses of the domain controllers.

+

+For the DNS server IP addresses to assign to your VNet, fill in the following table using as many rows as needed.

+

+|**DNS server IP addresses**|

+|:--|

+||

+||

+

+#### Traffic distribution

+Typical production SharePoint farms use load balancers to distribute traffic among the servers of a common role. Azure infrastructure services include a built-in load balancer that can be used in the following ways:

+

+- **Internet-facing:** Used in conjunction with a public IP address to distribute incoming Internet traffic to the VM members of a load balanced set.

+

+- **Internal:** Used in conjunction with an IP address of a subnet in the VNet to distribute incoming Internet traffic to the VM members of a load balanced set.

+

+Here are the recommendations for using Azure load balancers in your SharePoint Server 2016 farm in Azure:

+

+- Use the Azure load balancer or a load balancer network appliance for your front-end servers. If the SharePoint farm is designed to be accessible from the Internet, use an Internet-facing load balancer.

+

+- Use an internal Azure load balancer or a load balancer network appliance for the set of servers running applications and for the SQL server cluster (using the listener IP address).

+

+- Create the Azure load balancers or load balancer network appliances in the infrastructure or networking resource group.

+

+- Increase idle connection timeout to handle long duration connections from SharePoint clients with the [Set-AzureLoadBalancedEndpoint -IdleTimeoutInMinutes 15](/previous-versions/azure/dn495126(v=azure.100)) Azure PowerShell command.

+

+- The VM health probe can either be an HTTP get message or an ICMP Echo Request (ping) message, unless the load balancing network appliance is operating at layer 4, in which case an HTTP get message should be used.

+

+For the Azure load balancers, fill in the following table before creating them, using as many rows as needed.

+

+|**Load balancer name**|**Purpose**|**Type (Internet-facing or internal)**|

+|:--|:--|:--|

+||||

+||||

+

+#### Static addresses

+You can assign static IP addresses to VM network interfaces from the available subnet address space. If you are using an internal Azure load balancer to distribute traffic among the servers of a common role, assign the load balancer a static IP address from the subnet containing the members of the load balanced set.

+

+For a SharePoint Server farm in Azure, Microsoft recommends that you assign a static IP address for each server running SQL Server or SharePoint Server.

+

+For static IP addresses, fill in the following table, using as many rows as needed.

+

+|**VM or load balancer name**|**Static IP address**|

+|:--|:--|

+|||

+|||

+|||

+

+#### Public IP addresses

+A public IP address allows access to a load balancer or VM from the Internet. To reduce the surface area for malicious attacks, Microsoft recommends that you use public IP addresses only for the following:

+

+- For jumpbox VMs in a cloud-only network.

+

+ A jumpbox VM is a VM from which you initiate remote desktop connections to remotely manage the other VMs in the VNet. You do not need public IP addresses for each VM.

+

+- For an Internet-facing load balancer for externally-facing farms.

+

+ The public IP address provides access to the servers in the front-end role of the farm.

+

+For public IP addresses, fill in the following table, using as many rows as needed.

+

+|**VM or load balancer name**|

+|:--|

+||

+||

+

+Azure assigns public IP addresses at the time they are requested for the VM or load balancer.

+

+### Step 3: Storage

+Storage resources for VMs in Azure, which include the disks that each VM uses, are [managed disks](https://azure.microsoft.com/services/managed-disks/).

+

+Azure supports [standard and premium types of storage](/azure/storage/common/storage-introduction). To be in a supported configuration, you must use premium storage for the servers running SharePoint Server that host the search role. Microsoft recommends that you use premium storage for all VMs running SQL Server or SharePoint Servers. Other VMs in the farm, such as domain controllers and the VMs on the management subnet, can use standard storage.

+

+### Step 4: Identity

+SharePoint Server requires Windows Server AD domain membership. Therefore, a SharePoint Server farm in Azure must have access to an Windows Server AD domain either with VMs acting as domain controllers or with [Azure Active Directory (AD) Domain Services](/azure/active-directory-domain-services/active-directory-ds-overview).

+

+When using VMs acting as domain controllers:

+

+- For an Internet-only farm in a cloud-only VNet, create a standalone Windows Server AD forest with at least two VMs for availability.

+

+- For an intranet farm in a cross-premises VNet, you can use on-premises domain controllers. However, Microsoft recommends using at least two replica domain controllers for the on-premises Windows Server AD forest in the VNet containing the SharePoint farm.

+

+### Step 5: Security

+Use the following elements of Azure to provide security for the servers of the SharePoint farm:

+

+- For cloud-only VNets, use a jumpbox VM for remote desktop connections and assign the only public IP address to the jumpbox VM. Jumpbox VMs are optional for cross-premises VNets because the VMs of the SharePoint farm can be reached directly from the intranet.

+

+- Use subnet-based network security groups for subnet isolation. Network security groups and then the rules that define the traffic allowed into and out of the subnet. Place the network security groups in the resource group for infrastructure or networking components.

+

+For the network security groups, fill in the following table before creating them, using as many rows as needed.

+

+|**Network security group name**|**Subnet name**|**Rules**|

+|:--|:--|:--|

+||||

+||||

+||||

+

+### Step 6: Virtual machines

+For the virtual machines of the SharePoint farm, do the following:

+

+- Create an availability set for each set of VMs in a common role and place all of the VMs with the same server role in it.

+

+- Create the availability set in the resource group for the server role.

+

+- Use a minimum of two VMs for each server role.

+

+- If you are using SQL Server AlwaysOn Availability Groups and plan to use only two SQL servers, you must also use minority node server for the cluster.

+

+- Place the network interfaces and the VMs in the resource group for the server role.

+

+Here are the minimum recommended VM sizes:

+

+- Windows Server AD domain controllers: Standard_D2

+

+- SQL Servers: Standard_DS4

+

+- Minority node server: Standard_D2

+

+- SharePoint servers: Standard_DS4

+

+Addresses for network interfaces:

+

+- Use static private IP addresses for all interfaces of VMs that are domain controllers or running SharePoint Server or SQL Server.

+

+- Use a public IP address only for the jumpbox VM.

+

+- Use a public IP address for the Internet-facing load balancer for the front-end servers if the farm is exposed to the Internet.

+

+Each Azure VM includes an operating system disk. You can add extra disks when you create the VM or add them later. Use the following table for the minimum extra disks for the VMs in a SharePoint farm.

+

+|**Type of server**|**Extra disks**|

+|:--|:--|

+|Windows Server AD domain controllers <br/> |One 40 GB extra disk to store Windows Server AD information <br/> |

+|SQL Servers <br/> |Three 1 TB extra disks for data, logs, and temporary data <br/> |

+|Application or search servers <br/> |One 100 GB extra disk for logs, one 200 GB extra disk for the search index <br/> |

+|Front-end or distributed cache servers <br/> |One 100 GB extra disk for logs <br/> |

+

+For the availability sets, fill in the following table before creating them, using as many rows as needed.

+

+|**Availability set name**|**SharePoint farm role**|**Resource group**|

+|:--|:--|:--|

+||||

+||||

+

+For the network interfaces of VMs, fill in the following table before creating them, using as many rows as needed.

+

+|**Network interface name**|**Resource group**|**Subnet name**|**Static IP address**|**Load balancer instance (if needed)**|

+|:--|:--|:--|:--|:--|

+||||||

+||||||

+

+For the VMs, fill in the following table before creating them, using as many rows as needed.

+

+|**VM name**|**Purpose**|**Size**|**Availability set**|**Resource group**|**Network interface name**|

+|:--|:--|:--|:--|:--|:--|

+|||||||

+|||||||

+

+## Next steps

+If you are ready to create a proof-of-concept or dev/test configuration of an intranet SharePoint Server farm in Azure, see [Intranet SharePoint Server in Azure dev/test environment](intranet-sharepoint-server-in-azure-dev-test-environment.md).

+

+If you are ready to deploy a production-ready, high availability SharePoint Server farm in Azure, see [Deploying SharePoint Server with SQL Server AlwaysOn Availability Groups in Azure](deploying-sharepoint-server-with-sql-server-alwayson-availability-groups-in.md).

+

+## See also

+#### Concepts

+[SharePoint Server](../sharepoint-server.yml)

+

+[Install SharePoint Server](../install/install.md)

+#### Other Resources

+[SharePoint Server in Microsoft Azure](sharepoint-server-in-microsoft-azure.md)

+ Title: "Install Microsoft Identity Manager for User Profiles in SharePoint Server"

+audience: ITPro

+f1.keywords:

+- NOCSH

+ms.localizationpriority: medium

+- IT_Sharepoint_Server

+- IT_Sharepoint_Server_Top

+ms.assetid: 84972766-6527-4791-ae68-02d3a50b67f0

+description: "Learn about Microsoft Identity Manager (MIM) and how it's used for importing user profile information in SharePoint Server."

+# Install Microsoft Identity Manager for User Profiles in SharePoint Server

+

+ **Contents**

+

+- [What is Microsoft Identity Manager?](#what-is-microsoft-identity-manager)

+

+- [Choosing MIM for use with SharePoint Server](#choosing-mim-for-use-with-sharepoint-server)

+

+- [Installing Microsoft Identity Manager (MIM)](#installing-microsoft-identity-manager-mim)

+

+- [MIM configuration scenarios with SharePoint Server](#mim-configuration-scenarios-with-sharepoint-server)

+

+> [!IMPORTANT]

+> The solutions files referenced in this article are available for download [here](https://github.com/OfficeDev/PnP-Tools/tree/master/Solutions/UserProfile.MIMSync). You will need a GitHub account for access. For more information, see the section 'Download the solutions files that you need'. > Microsoft Identity Manager 2016 is available for download from the [Microsoft Volume Licensing Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx). (Log in and search on the product name.) > On your MIM server, be sure to install [KB3092179](https://support.microsoft.com/kb/3092179).

+

+## What is Microsoft Identity Manager?

+<a name="BKMK_WhatIsMIM1"> </a>

+Previous versions of SharePoint Server had a built-in copy of ForeFront Identity Manager (FIM) that ran inside SharePoint Server. That version of FIM powered the User Profile Synchronization for products like SharePoint Server 2010 and SharePoint Server 2013. But from SharePoint Server 2016, FIM has been removed in favor of Microsoft Identity Manager, which is the successor to the FIM technology. MIM is a separate server technology (not built-in to SharePoint Server). That means, if you have MIM running in your company, more than one SharePoint Server farm can rely upon it.

+

+It's also important to note, here, that Active Directory Import (sometimes called Active Directory Direct Import) is also included with SharePoint Server, and is a User Profile Synchronization alternative that will not need a separate server installation. This means that SharePoint Server offers two options for User Profile Sync.

+

+Which option is right for you?

+

+|&nbsp;|&nbsp;|&nbsp;|

+|:--|:--|:--|

+||**Microsoft Identity Management server** <br/> |**Active Directory Import** <br/> |

+|Pros <br/> |1. Flexibility allows for customized import. <br/> 2. Can be customized for bidirectional flow. <br/> 3. Imports user profile photos automatically. <br/> 4. Supports non-Active Directory LDAP sources. <br/> 5. Multi-forest scenarios are supported. <br/> |1. Very fast and performant. <br/> 2. Known to be reliable (used by Microsoft 365). <br/> 3. Configurable inside of Central Administration. (Less complex.) <br/> |

+|Cons <br/> |1. A separate MIM server is recommended for use with your SharePoint farm. <br/> 2. The more customized the more complex the architecture, deployment, and management. <br/> |1. Import is unidirectional (changes go from Active Directory to SharePoint Server Profile). <br/> 2. Import from a single Active Directory forest only. <br/> 3. Does not import user photos. <br/> 4. Supports Active Directory LDAP only. <br/> 5. Multi-forest scenarios are not supported. <br/> |

+

+> [!TIP]

+> If you need details, or you need to set up Active Directory Import for your SharePoint Server installation? Try [these steps](./configure-profile-synchronization-by-using-sharepoint-active-directory-import.md).

+

+## Choosing MIM for use with SharePoint Server

+<a name="BKMK_ChooseMIM"> </a>

+If you choose MIM, there are some **prerequisites** of which you should be aware. You will need:

+

+1. For SharePoint Server 2016, a Windows Server 2012 R2 computer or virtual machine for the installation of MIM components. For SharePoint Server 2019, a Windows Server 2016 computer is required. For SharePoint Server Subscription Edition, a Windows Server 2019 computer is required.

+

+2. SQL Server 2008 or above, to be installed either on the same machine as the MIM components, or remotely.

+

+ > [!NOTE]

+ > If you have SQL Server running on a *separate* server from MIM, you'll need to install SQL Server native client (either for [2008](/sql/sql-server/) or [2012](https://www.microsoft.com/download/details.aspx?id=29065)) where you installed MIM.

+

+3. You'll need to create a service account in your domain to run the MIM Synchronization Service. This account should have the "Log on as a service" permissions granted to it on the machine where the MIM Synchronization Service will be installed. These permissions will normally be assigned automatically during setup of the service but can be manually assigned via the Local Security Policy (secpol.msc).

+

+ > [!IMPORTANT]

+ > If SQL Server is on the same server as MIM, you may use a local account for this service. However, if you use a *remote* SQL, you must use a domain account. If the account is in another domain from the SQL Server, it must be in the same forest.

+

+4. A domain user account must be created and [permissioned properly](./user-profile-service-administration.md) for use in the Active Directory Connector.

+

+5. The account running setup for MIM must be a SQL Server Admin on the instance of SQL Server where the MIM sync database will be hosted. The account must have local administrator permissions on the machine where the MIM Synchronization service will be installed.

+

+6. Be sure that any accounts you maintain and use for testing/validation of the process have an email address configured in Active Directory. This will help you verify the success of your MIM configuration after import.

+

+## Installing Microsoft Identity Manager (MIM)

+<a name="BKMK_InstallMIM"> </a>

+During these steps, you'll actually install three different elements essential to MIM. The first install will be of the MIM software, itself. You'll also need the SharePoint Management Agent.

+

+1. First, download and install MIM to the server where you want to install.

+

+2. Extract the .zip file and double-click Setup.exe. (Setup.exe is usually found in the SynchronizationService folder of the MIM media.)

+

+3. Click **Next** > accept the end-user license agreement, and click **Next** through the feature selection screen. (You don't need to change the default selection.)

+

+4. The next screen in the wizard will ask you to supply some information about the instance of SQL Server that you want MIM to use. Choose This Computer if SQL Server is local, or type the name of the remote SQL Server instance. Indicate if SQL Server uses the default instance, or type the named instance. Click **Next**.

+

+5. Next, you type the credentials you want to use to run the MIM service. You won't need to configure extra permissions or policies in SQL server for this account (whether SQL Server is local or remote).

+

+ > [!NOTE]

+ > If you're installing to a remote instance of SQL Server, the SQL Server Native Client must already be installed on the MIM server before you install the MIM Synchronization Service.

+

+6. Next, set up the security groups that are needed for MIM to function. You can leave these as default if you wish, but in that case your security groups will be created on the local machine were MIM is being installed. If you have more than one machine configured to run MIM, you may want to create these security groups in Active Directory (AD). Do this in the same domain as the machines where MIM is configured, and enter the group names into this page of the wizard.

+

+7. The next step (firewall rules) is optional. We recommend you do not check the firewall rule checkbox.

+

+8. Click to install MIM.

+

+ > [!NOTE]

+ > You may see a Warning here (Warning 25051). Click **OK** to continue.

+

+9. Next, the wizard will create a backup of the encryption key set that it has created.

+

+ > [!NOTE]

+ > You will need to backup the keys generated at this point if you are to move to another database server. Save these keys to a secure location and make certain you backup the key file along with the database backup so they're both available in a disaster recovery scenario.

+

+10. MIM installation should complete. You should log off and back onto your server again to ensure the MIM cache is updated.

+

+11. Once you log on again, ensure the MIM service is running on the server by going to Services (or Start or Windows key> **Run** > services.msc) and then locating the **Forefront Identity Manager Synchronization Service**. No mistake. The service name has not changed!

+

+### Install the SharePoint Management Agent (Forefront Identity Manager Connector for SharePoint)

+SharePoint Management Agent (SPMA) is an essential if you need to connect MIM to your SharePoint Server installation. We'll install and configure it now.

+

+1. You need to install the SPMA on the same server as is running MIM. Install the latest SPMA bits from [here](https://www.microsoft.com/download/details.aspx?id=41164).

+

+2. Click **Download** and run the installation. You won't need to make any selections during this installation process.

+

+3. Restart the Forefront Identity Manager Synchronization Service (again, you can get to this via Start or Windows key > **Run** > services.msc)

+

+4. Once the installation completes, check Programs and Features in Control Panel on your MIM server to ensure you see **Forefront Identity Manager SharePoint Connector**.

+

+5. Launch the 'Synchronization Service' on the server to be certain that it opens. On a Windows Server 2012 R2 server, you'll find the icon for the Synchronization Service under Apps.

+

+The Synchronization Service Manager will open on your MIM server. At this point you must configure MIM for use with SharePoint Server.

+

+## MIM configuration scenarios with SharePoint Server

+<a name="BKMK_ConfigScene"> </a>

+For configuration steps, please see:

+

+- [Use a sample MIM solution in SharePoint Server](use-a-sample-mim-solution-in-sharepoint-server.md)

+ Title: "Intranet SharePoint Server in Azure dev/test environment"

+audience: ITPro

+f1.keywords:

+- CSH

+ms.localizationpriority: medium

+- Ent_O365

+- IT_Sharepoint_Server

+- IT_Sharepoint_Server_Top

+- Strat_O365_Enterprise

+- Ent_TLGs

+ms.assetid: 7fda5f6e-ffbc-40af-9e5d-62f055a9c9b0

+description: "Create an intranet SharePoint Server farm running in Microsoft Azure as a dev/test environment."

+# Intranet SharePoint Server in Azure dev/test environment

+

+This topic steps you through creating a simulated intranet SharePoint farm hosted in Azure. Here is the resulting configuration:

+

+**Figure 1: The SharePoint Server intranet in Azure dev/test environment**

+

+

+This configuration consists of:

+

+- A simulated and simplified on-premises network (the TestLab virtual network hosted in Azure).

+

+- A cross-premises virtual network hosted in Azure (the XPrem virtual network hosted in Azure).

+

+- VNet peering to connect the two virtual networks.

+

+- A single-server SharePoint farm (SP1 and SQL1) and secondary domain controller (DC2) in the XPrem virtual network.

+

+This configuration provides a basis and common starting point from which you can:

+

+- Perform testing of administration and the client experience before deploying a production version of this configuration

+

+- Develop and test applications on aa simulated SharePoint intranet farm running in Azure.

+

+There are three major phases to setting up this dev/test environment:

+

+1. Set up the simulated cross-premises environment.

+

+2. Configure the SQL server computer (SQL1).

+

+3. Configure the SharePoint server (SP1).

+

+> [!NOTE]

+> This configuration requires a paid Azure subscription. You cannot build this with an Azure Free Trial.

+

+## Phase 1: Set up the simulated cross-premises environment

+Use the instructions in [Simulated cross-premises virtual network in Azure](/office365/enterprise/simulated-cross-premises-virtual-network-in-azure) to create the following configuration:

+

+**Figure 2: The simulated cross-premises environment**

+

+

+Figure 2 shows the CorpNet and XPrem VNets with a DC2 virtual machine in the XPrem VNet.

+

+Because the intranet SharePoint dev/test environment does not require the presence of the APP1 server on the Corpnet subnet, feel free to shut it down for now.

+

+## Phase 2: Configure the SQL Server computer (SQL1)

+To create the SQL Server 2016 virtual machine with Azure PowerShell, supply the values for the variables. Then, run the resulting command block at the Azure PowerShell prompt or in the PowerShell Integrated Script Environment (ISE) on your local computer.

+

+

+```

+# Log in to Azure

+Connect-AzAccount

+# Set up key variables

+$subscrName="<name of your Azure subscription>"

+$rgName="<your resource group name>"

+# Set the Azure subscription

+Select-AzSubscription -SubscriptionName $subscrName

+# Get the Azure location

+$sa=Get-AzStorageaccount | where {$_.ResourceGroupName -eq $rgName}

+# Create an availability set for SQL Server virtual machines

+New-AzAvailabilitySet -ResourceGroupName $rgName -Name sqlAvailabilitySet -Location $locName -Sku Aligned -PlatformUpdateDomainCount 5 -PlatformFaultDomainCount 2

+# Create the SQL Server virtual machine

+$vmName="SQL1"

+$vmSize="Standard_D3_V2"

+$vnet=Get-AzVirtualNetwork -Name "XPrem" -ResourceGroupName $rgName

+$nicName=$vmName + "-NIC"

+$pipName=$vmName + "-PIP"

+$pip=New-AzPublicIpAddress -Name $pipName -ResourceGroupName $rgName -Location $locName -AllocationMethod Dynamic

+$nic=New-AzNetworkInterface -Name $nicName -ResourceGroupName $rgName -Location $locName -SubnetId $vnet.Subnets[0].Id -PublicIpAddressId $pip.Id -PrivateIpAddress "192.168.0.10"

+$avSet=Get-AzAvailabilitySet -Name sqlAvailabilitySet -ResourceGroupName $rgName

+$vm=New-AzVMConfig -VMName $vmName -VMSize $vmSize -AvailabilitySetId $avSet.Id

+$vm=Set-AzVMOSDisk -VM $vm -Name ($vmName +"-OS") -DiskSizeInGB 128 -CreateOption FromImage -StorageAccountType "StandardLRS"

+$diskSize=100

+$diskConfig=New-AzDiskConfig -AccountType "StandardLRS" -Location $locName -CreateOption Empty -DiskSizeGB $diskSize

+$dataDisk1=New-AzDisk -DiskName ($vmName + "-SQLData") -Disk $diskConfig -ResourceGroupName $rgName

+$vm=Add-AzVMDataDisk -VM $vm -Name ($vmName + "-SQLData") -CreateOption Attach -ManagedDiskId $dataDisk1.Id -Lun 1

+$cred=Get-Credential -Message "Type the name and password of the local administrator account of the SQL Server computer."

+$vm=Set-AzVMOperatingSystem -VM $vm -Windows -ComputerName $vmName -Credential $cred -ProvisionVMAgent -EnableAutoUpdate

+$vm=Set-AzVMSourceImage -VM $vm -PublisherName MicrosoftSQLServer -Offer SQL2016-WS2016 -Skus Standard -Version "latest"

+$vm=Add-AzVMNetworkInterface -VM $vm -Id $nic.Id

+New-AzVM -ResourceGroupName $rgName -Location $locName -VM $vm

+```

+Record the name and password of the local administrator account in a secure location.

+

+> [!NOTE]

+> This Azure PowerShell command block creates an Azure availability set for the SQL1 virtual machine. This is done in case you want to add more SQL Server virtual machines to this basic configuration.

+

+From the [Azure portal](https://portal.azure.com) on your local computer, connect to the SQL Server virtual machine (SQL1) using the credentials of the local administrator account.

+

+Next, join the SQL Server to the Windows Server AD domain with these commands at a Windows PowerShell prompt on SQL1.

+

+```

+Add-Computer -DomainName "corp.contoso.com"

+Restart-Computer

+```

+Note that you must supply domain account credentials after entering the **Add-Computer** command. Use the CORP\User1 account and password.

+

+After the SQL Server virtual machine restarts, reconnect to it using the local administrator account.

+

+From a Windows PowerShell command prompt on SQL1, run the following commands to prepare the extra data disk:

+

+```

+Get-Disk | Where PartitionStyle -eq "RAW" | Initialize-Disk -PartitionStyle MBR -PassThru | New-Partition -AssignDriveLetter -UseMaximumSize | Format-Volume -FileSystem NTFS -NewFileSystemLabel "SQL Data"

+md f:\Data

+md f:\Log

+md f:\Backup

+```

+SQL Server requires a port that SQL clients use to access the database server. It also needs ports to connect with the SQL Server Management Studio. Run the following command at the Windows PowerShell command prompt on SQL1:

+

+```

+New-NetFirewallRule -DisplayName "SQL Server ports 1433, 1434, and 5022" -Direction Inbound -Protocol TCP -LocalPort 1433,1434,5022 -Action Allow

+```

+Next, configure SQL1 to use the F: drive for new databases and for accounts and permissions.

+

+1. On the Start screen, type **studio**, and then click **Microsoft SQL Server Management Studio**. It might take a few minutes to load user settings.

+

+2. In **Connect to Server**, click **Connect**.

+

+3. In the left pane, right-click the top nodeΓÇöthe default instance named after the machineΓÇöand then click **Properties**.

+

+4. In **Server Properties**, click **Database Settings**.

+

+5. In **Database default locations**, set the following values:

+

+ - For **Data**, set the path to **f:\Data**.

+

+ - For **Log**, set the path to **f:\Log**.

+

+ - For **Backup**, set the path to **f:\Backup**.

+

+6. Click **OK** to close the window.

+

+7. In the left pane, expand the **Security** folder.

+

+8. Right-click **Logins**, and then click **New login**.

+

+9. In **Login name**, type **CORP\User1**.

+

+10. Under **Select a page**, click **Server Roles**, click **sysadmin**, and then click **OK**.

+

+11. Close SQL Server Management Studio.

+

+Sign out as the local administrator.

+

+Here is the result of Phase 2:

+

+**Figure 3: The addition of SQL1**

+

+

+Figure 3 shows the CorpNet and XPrem VNets with the additional SQL1 virtual machine in the XPrem VNet.

+

+## Phase 3: Configure the SharePoint server (SP1)

+In this phase, you create a SharePoint Server virtual machine in your virtual network, make it a member of the Windows Server AD domain, and then create a new single-server SharePoint farm.

+

+First, you must create a new Windows Server AD account for the SharePoint farm. From the [Azure portal](https://portal.azure.com) on your local computer, connect to DC2. Then, run the following command from an administrator-level Windows PowerShell command prompt on DC2:

+

+```

+New-ADUser -SamAccountName sp_farm_db -AccountPassword (read-host "Set user password" -assecurestring) -name "sp_farm_db" -enabled $true -PasswordNeverExpires $true -ChangePasswordAtLogon $false

+```

+You will be prompted to supply the password for the sp_farm_db account. Record the password in a secure location.

+

+Next, to create the SharePoint Server virtual machine with Azure PowerShell, supply the values of the variables. Then, run the resulting block at the Azure PowerShell prompt on your local computer:

+

+```

+# Set up key variables

+$subscrName="<name of your Azure subscription>"

+$rgName="<your resource group name>"

+# Set the Azure subscription

+Select-AzSubscription -SubscriptionName $subscrName

+# Get the Azure location and storage account name

+$locName=(Get-AzResourceGroup -Name $rgName).Location

+$saName=(Get-AzStorageaccount | Where {$_.ResourceGroupName -eq $rgName}).StorageAccountName

+# Create an availability set for SharePoint virtual machines

+New-AzAvailabilitySet -ResourceGroupName $rgName -Name spAvailabilitySet -Location $locName -Sku Aligned -PlatformUpdateDomainCount 5 -PlatformFaultDomainCount 2

+# Create the SharePoint virtual machine

+$vmName="SP1"

+$vmSize="Standard_D3_V2"

+$vm=New-AzVMConfig -VMName $vmName -VMSize $vmSize

+$nicName=$vmName + "-NIC"

+$pipName=$vmName + "-PIP"

+$pip=New-AzPublicIpAddress -Name $pipName -ResourceGroupName $rgName -Location $locName -AllocationMethod Dynamic

+$vnet=Get-AzVirtualNetwork -Name "XPrem" -ResourceGroupName $rgName

+$nic=New-AzNetworkInterface -Name $nicName -ResourceGroupName $rgName -Location $locName -SubnetId $vnet.Subnets[0].Id -PublicIpAddressId $pip.Id -PrivateIpAddress "192.168.0.11"

+$avSet=Get-AzAvailabilitySet -Name spAvailabilitySet -ResourceGroupName $rgName

+$vm=New-AzVMConfig -VMName $vmName -VMSize $vmSize -AvailabilitySetId $avSet.Id

+$pubName="MicrosoftSharePoint"

+$offerName="MicrosoftSharePointServer"

+$skuName="2016"

+$cred=Get-Credential -Message "Type the name and password of the local administrator account of the SharePoint server."

+$vm=Set-AzVMOperatingSystem -VM $vm -Windows -ComputerName $vmName -Credential $cred -ProvisionVMAgent -EnableAutoUpdate

+$vm=Set-AzVMSourceImage -VM $vm -PublisherName $pubName -Offer $offerName -Skus $skuName -Version "latest"

+$vm=Add-AzVMNetworkInterface -VM $vm -Id $nic.Id

+$vm=Set-AzVMOSDisk -VM $vm -Name "DC1-OS" -DiskSizeInGB 128 -CreateOption FromImage -StorageAccountType "StandardLRS"

+New-AzVM -ResourceGroupName $rgName -Location $locName -VM $vm

+```

+Record the name and password of the local administrator account in a secure location.

+

+> [!NOTE]

+> This Azure PowerShell command block creates an Azure availability set for the SP1 virtual machine. This is done in case you want to add more SharePoint Server 2016 virtual machines to this basic configuration.

+

+### Configure the SharePoint Server virtual machine

+From the [Azure portal](https://portal.azure.com) on your local computer, connect to the SharePoint virtual machine (SP1) using the credentials of its local administrator account.

+

+Join the SharePoint virtual machine to the Windows Server AD domain with these commands at the Windows PowerShell prompt on SP1:

+

+```

+Add-Computer -DomainName "corp.contoso.com"

+Restart-Computer

+```

+Note that you must supply domain account credentials after entering the **Add-Computer** command. Use the CORP\User1 account name and password.

+

+After the SharePoint virtual machine restarts, reconnect to it using the CORP\User1 account name and password.

+

+Next, create a new, single-server SharePoint farm on SP1.

+

+1. From the Start screen, type **SharePoint**, and then click **SharePoint 2016 Products Configuration Wizard**.

+

+2. On the **Welcome to SharePoint Products** page, click **Next**.

+

+3. A **SharePoint Products Configuration Wizard** dialog appears, warning that services (such as IIS) will be restarted or reset. Click **Yes**.

+

+4. On the **Connect to a server farm** page, select **Create a new server farm**, and then click **Next**.

+

+5. On the **Specify Configuration Database Settings** page:

+

+ - In **Database server**, type **SQL1**.

+

+ - In **Username**, type **CORP\sp_farm_db**.

+

+ - In **Password**, type the sp_farm_db account password.

+

+6. Click **Next**.

+

+ If the SQL1 server cannot be found, ensure that you ran this command from an administrator-level Windows PowerShell command prompt on SQL1:

+

+ ```

+ New-NetFirewallRule -DisplayName "SQL Server ports 1433, 1434, and 5022" -Direction Inbound -Protocol TCP -LocalPort 1433,1434,5022 -Action Allow

+ ```

+7. On the **Specify Farm Security Settings** page, type a passphrase twice. Record the passphrase and store it in a secure location for future reference. Click **Next**.

+

+8. On the **Specify Server Role** page, in **Single-Server Farm**, click **Single-Server Farm**, and then click **Next**.

+

+9. On the **Configure SharePoint Central Administration Web Application** page, click **Next**.

+

+10. The **Completing the SharePoint Products Configuration Wizard** page appears. Click **Next**.

+

+11. The **Configuring SharePoint Products** page appears. Wait until the configuration process completes.

+

+12. On the **Configuration Successful** page, click **Finish**. The new administration website starts.

+

+13. On the **Help Make SharePoint Better** page, click your choice to participate in the Customer Experience Improvement Program, and then click **OK**.

+

+14. On the **Welcome** page, click **Start the Wizard**.

+

+15. On the **Service Applications and Services** page, in **Service Account**, click **Use existing managed account**, and then click **Next**. It can take a few minutes to display the next page.

+

+16. On the **Create Site Collection** page, type **Contoso** in **Title**, and then click **OK**.

+

+17. On the **This completes the Farm Configuration Wizard** page, click **Finish**. The SharePoint Central Administration web page displays.

+

+18. From the [Azure portal](https://portal.azure.com) on your local computer, connect to the CLIENT1 VM.

+

+19. From CLIENT1, open a new tab in Internet Explorer, type **http://sp1/** in the Address bar, and then press Enter. You should see the default Contoso team site.

+

+Here is the result of Phase 3:

+

+**Figure 4: The addition of SP1**

+

+

+Figure 4 shows the CorpNet and XPrem VNets with the SP1 and SQL1 virtual machines in the XPrem VNet.

+

+Your emulated intranet SharePoint Server farm running in Azure is now ready for testing.

+

+## Next steps

+When you are ready to design a production SharePoint Server farm in Azure, see [Designing a SharePoint Server farm in Azure](designing-a-sharepoint-server-farm-in-azure.md).

+

+When you are ready to deploy a production-ready, high availability SharePoint Server farm in Azure, see [Deploying SharePoint Server with SQL Server AlwaysOn Availability Groups in Azure](deploying-sharepoint-server-with-sql-server-alwayson-availability-groups-in.md).

+

+## See also

+- [SharePoint Server dev/test environment in Azure](sharepoint-server-dev-test-environment-in-azure.md)

+- [SharePoint Server in Microsoft Azure](sharepoint-server-in-microsoft-azure.md)

+- [Designing a SharePoint Server farm in Azure](designing-a-sharepoint-server-farm-in-azure.md)

+ Title: "Microsoft Identity Manager in SharePoint Server"

+audience: ITPro

+f1.keywords:

+- NOCSH

+ms.localizationpriority: medium

+- IT_Sharepoint_Server

+- IT_Sharepoint_Server_Top

+ms.assetid: fee4c4d8-a7f2-4392-99ce-b122e918c081

+description: "Learn about the Microsoft Identity Manager (MIM) in SharePoint Server and the features it provides to you as an external identity manager."

+# Microsoft Identity Manager in SharePoint Server

+

+When it comes to User Profile synchronization, there are more options in SharePoint Server 2016 than previous versions.

+> [!NOTE]

+> The options available in SharePoint 2016 (not just pertaining to User Profile synchronization) are also available in SharePoint 2019 and SharePoint Subscription Edition (SE).

+The articles in this section provide information on MIM and how to use it in SharePoint Server 2016.

+

+## Articles relating to MIM in SharePoint Server

+|**Content**|**Description**|

+|:--|:--|

+|[Installing Microsoft Identity Manager (MIM)](install-microsoft-identity-manager-for-user-profiles-in-sharepoint-server.md#BKMK_InstallMIM) <br/> | Learn about Microsoft Identity Manager (MIM) and how it's used for importing user profile information in SharePoint Server. <br/> |

+|[Use a sample MIM solution in SharePoint Servers](use-a-sample-mim-solution-in-sharepoint-server.md) <br/> |How to configure SharePoint Server 2016 profile synchronization with Microsoft Identity Manager (MIM). <br/> |

+|[Overview of Microsoft Identity Manager Synchronization Service in SharePoint Servers](overview-of-microsoft-identity-manager-synchronization-service-in-sharepoint-ser.md) <br/> |Learn about the MIM Synchronization service that is used in a SharePoint Server farm. <br/> |

+|[Deployment considerations for implementing Microsoft Identity Manager with SharePoint Servers](deployment-considerations-for-implementing-microsoft-identity-manager-with-share.md) <br/> | Learn about deployment considerations of a Microsoft Identity Manager (MIM) deployment in a SharePoint Server farm. <br/> |

+

+**Table: Mobile authentication support matrix for the SharePoint Newsfeed App**\

+|**Authentication type** <br/> |**Authentication protocol** <br/> |**ID provider** <br/> |**SharePoint deployment** <br/> |**Handled through:** <br/> |**Windows Phone 7.5 Apps** <br/> |**Windows Phone 8 Apps** <br/> |**Windows 8 Apps** <br/> |**iOS 6.x or later versions Apps** <br/> |

+|--|--|--|--|--|--|--|--|--|

+|**Windows Authentication** <br/> |NTLM <br/> |Active Directory <br/> |On-premises <br/> |NTLM <br/> |No <br/> |No <br/> |Yes <br/> |Yes <br/> |

+|Basic Authentication <br/> |HTTPS <br/> |Active Directory <br/> |On-premises, extranet <br/> |Basic Authentication <br/> |Yes <br/> |Yes <br/> |No <br/> |Yes (https)|

+|**Forms-Based Authentication (FBA)** <br/> |FBA <br/> |Active Directory, LDAP, SQL <br/> |On-premises, extranet <br/> |MSOFBA <br/> |Yes <br/> |Yes <br/> |No <br/> |Yes <br/> |

+|FBA <br/> |FBA <br/> |OrgID <br/> |SharePoint, hybrid-based scenarios <br/> |MSOFBA <br/> |Yes <br/> |Yes <br/> |No <br/> |Yes|

+|FBA <br/> |FBA <br/> |OrgID <br/> |SharePoint, hybrid-based scenarios <br/> |Active Authentication(IDCRL) <br/> |No <br/> |No <br/> |Yes <br/> | Yes|

+|**SAML (token-based)** <br/> |SAML <br/> |WS-Federation 1.1 compatible Identity Provider <br/> |On-premises, SharePoint in Microsoft 365, hybrid-based scenarios <br/> |MSOFBA <br/> |Yes <br/> |Yes <br/> |No <br/> |Yes <br/> |

+|SAML <br/> |SAML <br/> |WS-Federation 1.1 compatible Identity Provider <br/> |On-premises, SharePoint in Microsoft 365, hybrid -based scenarios <br/> |Active Authentication(IDCRL) <br/> |No <br/> |No <br/> |Yes <br/> |Yes|

+

+ Title: "Overview of Microsoft Identity Manager Synchronization Service in SharePoint Server"

+# Overview of Microsoft Identity Manager Synchronization Service in SharePoint Server

+Previous versions of SharePoint Server had a built-in copy of ForeFront Identity Manager (FIM) that ran inside SharePoint Server that allow user profile synchronization to occur. That version of FIM powered the User Profile Synchronization for products like SharePoint Server 2010 and SharePoint Server 2013. But from SharePoint Server 2016, FIM has been removed in favor of Microsoft Identity Manager, which is the successor to the FIM technology. Even though FIM has been removed, the basic architecture for MIM uses some of the same FIM technology. For additional information on FIM technology, see [FIM 2010 Technical Overview](/previous-versions/mim/ff621362(v=ws.10))

+MIM is a separate server technology (not built-in to SharePoint Server). That means, if you have MIM, specifically the MIM Synchronization Service, running in your company, more than one SharePoint Server farm can rely upon it.

+It's also important to note here, that Active Directory Import (sometimes called Active Directory Direct Import) is also included with SharePoint Server, and is a User Profile Synchronization alternative that will not need a separate server installation. This means that SharePoint Server offers two options for User Profile Sync.

+> The MIM Synchronization Service is just one of several components that are offered by Microsoft Identity Manager 2016 . With SharePoint Servers, the only component that is free to use is the MIM Synchronization service. All other components of Microsoft® Identity Manager 2016 require a license to use, but the use of the MIM Synchronization service in SharePoint Server is free. For additional information about Microsoft Identity Manager 2016, see [Microsoft Identity Manager](https://go.microsoft.com/fwlink/?linkid=838921)

+A typical SharePoint Server topology of a MIM implementation may look like the following diagram.

+Now that you have a basic understanding of the general terms of an identity manager and how the MIM Synchronization Service works in SharePoint Server, the next thing you probably want to know is how to install a working MIM solution in SharePoint Server. [Installing Microsoft Identity Manager (MIM)](install-microsoft-identity-manager-for-user-profiles-in-sharepoint-server.md#installing-microsoft-identity-manager-mim) describes how to install MIM, and [Use a sample MIM solution in SharePoint Servers](use-a-sample-mim-solution-in-sharepoint-server.md#use-a-sample-mim-solution-in-sharepoint-server) shows how to use a sample MIM solution.

+[Deployment considerations for implementing Microsoft Identity Manager with SharePoint Server](deployment-considerations-for-implementing-microsoft-identity-manager-with-share.md#deployment-considerations-for-implementing-microsoft-identity-manager-with-sharepoint-server)

+Virtualization provides a workable and cost effective option for a warm standby recovery solution. You can use Hyper-V as an in-house solution or Azure as a hosted solution to provide necessary infrastructure for recovery. For more information, see [Deploying SharePoint Server with SQL Server AlwaysOn Availability Groups in Azure](deploying-sharepoint-server-with-sql-server-alwayson-availability-groups-in.md)

+[SharePoint Server in Microsoft Azure](sharepoint-server-in-microsoft-azure.md)

+- [Install Microsoft Identity Manager for User Profiles in SharePoint Server](install-microsoft-identity-manager-for-user-profiles-in-sharepoint-server.md)

+- [Use a sample MIM solution in SharePoint Server](use-a-sample-mim-solution-in-sharepoint-server.md)

+|[Custom Tiles in SharePoint Server](custom-tiles-in-sharepoint-server.md) <br/> |This article describes Custom Tiles which is one of the new features in the November 2016 Public Update for SharePoint Server 2016 (Feature Pack 1). <br/> |

+See the instructions in [SharePoint Server dev/test environment in Azure](./sharepoint-server-dev-test-environment-in-azure.md) to create the following single-server, SharePoint dev/test farm:.

+[SharePoint Server dev/test environment in Azure](./sharepoint-server-dev-test-environment-in-azure.md)

+In this phase of deploying an intranet-only SharePoint Server 2016 farm in Azure, you build out the Azure infrastructure. You must complete this phase before moving on to [SharePoint Intranet Farm in Azure Phase 2: Configure domain controllers](sharepoint-intranet-farm-in-azure-phase-2-configure-domain-controllers.md). See [Deploying SharePoint Server with SQL Server AlwaysOn Availability Groups in Azure](./deploying-sharepoint-server-with-sql-server-alwayson-availability-groups-in.md) for all of the phases.

+> The following command sets use the latest version of Azure PowerShell. See [Get started with Azure PowerShell cmdlets](/powershell/azure/overview?view=azurermps-6.13.0&preserve-view=true).

+[Deploying SharePoint Server with SQL Server AlwaysOn Availability Groups in Azure](./deploying-sharepoint-server-with-sql-server-alwayson-availability-groups-in.md)

+[SharePoint Server in Microsoft Azure](./sharepoint-server-in-microsoft-azure.md)

+[Designing a SharePoint Server farm in Azure](./designing-a-sharepoint-server-farm-in-azure.md)

+You must complete this phase before moving on to [SharePoint Intranet Farm in Azure Phase 3: Configure SQL Server Infrastructure](sharepoint-intranet-farm-in-azure-phase-3-configure-sql-server-infrastructure.md). See [Deploying SharePoint Server with SQL Server AlwaysOn Availability Groups in Azure](./deploying-sharepoint-server-with-sql-server-alwayson-availability-groups-in.md) for all of the phases.

+> The following command sets use the latest version of Azure PowerShell. See [Get started with Azure PowerShell cmdlets](/powershell/azure/overview?view=azurermps-6.13.0&preserve-view=true).

+[Deploying SharePoint Server with SQL Server AlwaysOn Availability Groups in Azure](./deploying-sharepoint-server-with-sql-server-alwayson-availability-groups-in.md)

+[SharePoint Server in Microsoft Azure](./sharepoint-server-in-microsoft-azure.md)

+[Designing a SharePoint Server farm in Azure](./designing-a-sharepoint-server-farm-in-azure.md)

+You must complete this phase before moving on to [SharePoint Intranet Farm in Azure Phase 4: Configure SharePoint servers](sharepoint-intranet-farm-in-azure-phase-4-configure-sharepoint-servers.md). See [Deploying SharePoint Server with SQL Server AlwaysOn Availability Groups in Azure](./deploying-sharepoint-server-with-sql-server-alwayson-availability-groups-in.md) for all of the phases.

+> The following command sets use the latest version of Azure PowerShell. See [Get started with Azure PowerShell cmdlets](/powershell/azure/overview?view=azurermps-6.13.0&preserve-view=true).

+[Deploying SharePoint Server with SQL Server AlwaysOn Availability Groups in Azure](./deploying-sharepoint-server-with-sql-server-alwayson-availability-groups-in.md)

+[SharePoint Server in Microsoft Azure](./sharepoint-server-in-microsoft-azure.md)

+[Designing a SharePoint Server farm in Azure](./designing-a-sharepoint-server-farm-in-azure.md)

+You must complete this phase before moving on to [SharePoint Intranet Farm in Azure Phase 5: Create the availability group and add the SharePoint databases](sharepoint-intranet-farm-in-azure-phase-5-create-the-availability-group-and-add.md). See [Deploying SharePoint Server with SQL Server AlwaysOn Availability Groups in Azure](./deploying-sharepoint-server-with-sql-server-alwayson-availability-groups-in.md) for all of the phases.

+> The following command sets use the latest version of Azure PowerShell. See [Get started with Azure PowerShell cmdlets](/powershell/azure/overview?view=azurermps-6.13.0&preserve-view=true).

+[Deploying SharePoint Server with SQL Server AlwaysOn Availability Groups in Azure](./deploying-sharepoint-server-with-sql-server-alwayson-availability-groups-in.md)

+[SharePoint Server in Microsoft Azure](./sharepoint-server-in-microsoft-azure.md)

+[Designing a SharePoint Server 2016 farm in Azure](./designing-a-sharepoint-server-farm-in-azure.md)

+See [Deploying SharePoint Server with SQL Server AlwaysOn Availability Groups in Azure](./deploying-sharepoint-server-with-sql-server-alwayson-availability-groups-in.md) for all of the phases.

+[Deploying SharePoint Server with SQL Server AlwaysOn Availability Groups in Azure](./deploying-sharepoint-server-with-sql-server-alwayson-availability-groups-in.md)

+[SharePoint Server in Microsoft Azure](./sharepoint-server-in-microsoft-azure.md)

+[Designing a SharePoint Server farm in Azure](./designing-a-sharepoint-server-farm-in-azure.md)

+ Title: "SharePoint Server dev/test environment in Azure"

+audience: ITPro

+f1.keywords:

+- CSH

+ms.localizationpriority: medium

+- IT_Sharepoint_Server

+- IT_Sharepoint_Server_Top

+- Strat_O365_Enterprise

+- Ent_TLGs

+ms.assetid: 056e74ea-9428-45f8-abed-1040d8e413dd

+description: "Create a single-server SharePoint 2016 dev/test farm in Microsoft Azure infrastructure services."

+# SharePoint Server dev/test environment in Azure

+

+This article steps you through the creation of a SharePoint Server dev/test farm hosted in Azure. Here is the resulting configuration.

+

+

+

+This configuration consists of a single-server SharePoint Server farm in a subnet of an Azure virtual network, which provides a basis and common starting point from which you can demonstrate SharePoint Server 2016 and develop and test SharePoint applications.

+

+There are three major phases to setting up this dev/test environment:

+

+1. Set up the virtual network and domain controller (adVM).

+

+2. Configure the SQL Server computer (sqlVM).

+

+3. Configure the SharePoint server (spVM).

+

+> [!NOTE]

+> This configuration requires a paid Azure subscription. You cannot build this with an Azure Free Trial.

+

+## Phase 1: Deploy the virtual network and a domain controller

+In this phase, you create a new Azure virtual network and a domain controller with Azure PowerShell. You run the PowerShell commands from a Windows PowerShell command prompt or in the PowerShell Integrated Script Environment (ISE) on your local computer.

+

+> [!NOTE]

+> The following command sets use the latest version of Azure PowerShell. See [Get started with Azure PowerShell cmdlets](/powershell/azure/overview?view=azurermps-6.13.0&preserve-view=true).

+

+First, sign into your Azure account.

+

+```

+Connect-AzAccount

+```

+Get your subscription name using the following command.

+

+```

+Get-AzSubscription | Sort Name | Select Name

+```

+Set your Azure subscription with the following commands. Set the **$subscr** variable by replacing everything within the quotes, including the < and > characters, with the correct name.

+

+```

+$subscr="<subscription name>"

+Select-AzSubscription -SubscriptionName $subscr

+```

+Next, create a new resource group. To determine a unique resource group name, use this command to list your existing resource groups.

+

+```

+Get-AzResourceGroup | Sort ResourceGroupName | Select ResourceGroupName

+```

+Create your new resource group with these commands. Set the variables by replacing everything within the quotes, including the \< and \> characters, with the correct names.

+

+```

+$rgName="<resource group name>"

+$locName="<location name, such as West US>"

+New-AzResourceGroup -Name $rgName -Location $locName

+```

+Next, you create the SP2016Vnet Azure Virtual Network that will host the SP2016Subnet subnet and protect it with a network security group.

+

+```

+$rgName="<name of your new resource group>"

+$locName=(Get-AzResourceGroup -Name $rgName).Location

+$spSubnet=New-AzVirtualNetworkSubnetConfig -Name SP2016Subnet -AddressPrefix 10.0.0.0/24

+New-AzVirtualNetwork -Name SP2016Vnet -ResourceGroupName $rgName -Location $locName -AddressPrefix 10.0.0.0/16 -Subnet $spSubnet -DNSServer 10.0.0.4

+$rule1=New-AzNetworkSecurityRuleConfig -Name "RDPTraffic" -Description "Allow RDP to all VMs on the subnet" -Access Allow -Protocol Tcp -Direction Inbound -Priority 100 -SourceAddressPrefix Internet -SourcePortRange * -DestinationAddressPrefix * -DestinationPortRange 3389

+$rule2 = New-AzNetworkSecurityRuleConfig -Name "WebTraffic" -Description "Allow HTTP to the SharePoint server" -Access Allow -Protocol Tcp -Direction Inbound -Priority 101 -SourceAddressPrefix Internet -SourcePortRange * -DestinationAddressPrefix "10.0.0.6/32" -DestinationPortRange 80

+New-AzNetworkSecurityGroup -Name SP2016Subnet -ResourceGroupName $rgName -Location $locName -SecurityRules $rule1, $rule2

+$vnet=Get-AzVirtualNetwork -ResourceGroupName $rgName -Name SP2016Vnet

+$nsg=Get-AzNetworkSecurityGroup -Name SP2016Subnet -ResourceGroupName $rgName

+Set-AzVirtualNetworkSubnetConfig -VirtualNetwork $vnet -Name SP2016Subnet -AddressPrefix "10.0.0.0/24" -NetworkSecurityGroup $nsg

+$vnet | Set-AzVirtualNetwork

+```

+Next, we create the adVM virtual machine in Azure. adVM is a domain controller for the corp.contoso.com Windows Server Active Directory (AD) domain and a DNS server for the virtual machines of the SP2016Vnet virtual network.

+

+First, fill in the name of your resource group and run these commands at the Azure PowerShell command prompt on your local computer to create an Azure virtual machine for adVM.

+

+```

+$rgName="<resource group name>"

+# Get the location

+$locName=(Get-AzResourceGroup -Name $rgName).Location

+# Create an availability set for domain controller virtual machines

+New-AzAvailabilitySet -ResourceGroupName $rgName -Name dcAvailabilitySet -Location $locName -Sku Aligned -PlatformUpdateDomainCount 5 -PlatformFaultDomainCount 2

+# Create the adVM virtual machine

+$vmName="adVM"

+$vmSize="Standard_D1_v2"

+$vnet=Get-AzVirtualNetwork -Name SP2016Vnet -ResourceGroupName $rgName

+$pip = New-AzPublicIpAddress -Name ($vmName + "-PIP") -ResourceGroupName $rgName -Location $locName -AllocationMethod Dynamic

+$nic = New-AzNetworkInterface -Name ($vmName + "-NIC") -ResourceGroupName $rgName -Location $locName -SubnetId $vnet.Subnets[0].Id -PublicIpAddressId $pip.Id -PrivateIpAddress 10.0.0.4

+$avSet=Get-AzAvailabilitySet -Name dcAvailabilitySet -ResourceGroupName $rgName

+$vm=New-AzVMConfig -VMName $vmName -VMSize $vmSize -AvailabilitySetId $avSet.Id

+$vm=Set-AzVMOSDisk -VM $vm -Name ($vmName +"-OS") -DiskSizeInGB 128 -CreateOption FromImage -StorageAccountType "Standard_LRS"

+$diskConfig=New-AzDiskConfig -AccountType "Standard_LRS" -Location $locName -CreateOption Empty -DiskSizeGB 20

+$dataDisk1=New-AzDisk -DiskName ($vmName + "-DataDisk1") -Disk $diskConfig -ResourceGroupName $rgName

+$vm=Add-AzVMDataDisk -VM $vm -Name ($vmName + "-DataDisk1") -CreateOption Attach -ManagedDiskId $dataDisk1.Id -Lun 1

+$cred=Get-Credential -Message "Type the name and password of the local administrator account for adVM."

+$vm=Set-AzVMOperatingSystem -VM $vm -Windows -ComputerName adVM -Credential $cred -ProvisionVMAgent -EnableAutoUpdate

+$vm=Set-AzVMSourceImage -VM $vm -PublisherName MicrosoftWindowsServer -Offer WindowsServer -Skus 2012-R2-Datacenter -Version "latest"

+$vm=Add-AzVMNetworkInterface -VM $vm -Id $nic.Id

+New-AzVM -ResourceGroupName $rgName -Location $locName -VM $vm

+```

+You will be prompted for a user name and password. This article will refer to this user name as ADMIN_NAME. Use a strong password and record both in a secure location.

+

+> [!NOTE]

+> The password that you specify cannot be "pass@word1". It must be between 8-123 characters long and must satisfy at least 3 of the following password complexity requirements: > Contains an uppercase letter > Contains an lowercase letter > Contains a numeric digit > Contains a special character

+

+It can take a few minutes for Azure to build the virtual machine.

+

+Use these steps to connect to the domain controller virtual machine using local administrator account credentials:

+

+1. In the [Azure portal](https://portal.azure.com), click **Resource Groups \>** \<the name of your new resource group> **\> adVM \> Connect**.

+

+2. Run the adVM.rdp file that is downloaded, and then click **Connect**.

+

+3. In **Windows Security**, click **Use another account**. In **User name**, type **adVM**\\<ADMIN_NAME>.

+

+4. In **Password**, type the password of the ADMIN_NAME account, and then click **OK**.

+

+5. When prompted, click **Yes**.

+

+Next, add an extra data disk as a new volume with the drive letter F: with these commands at an administrator-level Windows PowerShell command prompt.

+

+```

+Get-Disk | Where PartitionStyle -eq "RAW" | Initialize-Disk -PartitionStyle GPT -PassThru | New-Partition -AssignDriveLetter -UseMaximumSize | Format-Volume -FileSystem NTFS -NewFileSystemLabel "WSAD Data"

+```

+Next, configure adVM as a domain controller and DNS server for the corp.contoso.com domain. Run these commands at an administrator-level Windows PowerShell command prompt on adVM.

+

+```

+Install-WindowsFeature AD-Domain-Services -IncludeManagementTools

+Install-ADDSForest -DomainName corp.contoso.com -DatabasePath "F:\NTDS" -SysvolPath "F:\SYSVOL" -LogPath "F:\Logs"

+```

+Note that these commands can take a few minutes to complete.

+

+After adVM restarts, reconnect to the adVM virtual machine.

+

+ **Connect to the domain controller virtual machine using domain credentials**

+

+1. In the [Azure portal](https://portal.azure.com), click **Resource Groups \>** \<your resource group name> **\> adVM \> Connect**.

+

+2. Run the adVM.rdp file that is downloaded, and then click **Connect**.

+

+3. In **Windows Security**, click **Use another account**. In **User name**, type **CORP**\\<ADMIN_NAME>.

+

+4. In **Password**, type the password of the ADMIN_NAME account, and then click **OK**.

+

+5. When prompted, click **Yes**.

+

+From the desktop on adVM, open an administrator-level Windows PowerShell command prompt and run the following commands:

+

+```

+Add-WindowsFeature RSAT-ADDS-Tools

+New-ADUser -SamAccountName sp_farm_db -AccountPassword (read-host "Set user password" -assecurestring) -name "sp_farm_db" -enabled $true -PasswordNeverExpires $true -ChangePasswordAtLogon $false

+```

+Record the password for the sp_farm_db account in a secure location.

+

+Here is the result of Phase 1.

+

+

+

+## Phase 2: Add and configure a SQL Server 2014 virtual machine

+In this phase, you create a SQL Server 2014 virtual machine in your virtual network, make it a member of the Windows Server AD domain, and prepare it for SharePoint.

+

+To create the SQL Server 2014 virtual machine with Azure PowerShell, supply the values for the variables. Then, run the resulting block at the Azure PowerShell prompt or in the PowerShell Integrated Script Environment (ISE) on your local computer.

+

+```

+# Log in to Azure

+Connect-AzAccount

+# Set up key variables

+$subscrName="<name of your Azure subscription>"

+$rgName="<your resource group name>"

+# Set the Azure subscription and location

+Select-AzSubscription -SubscriptionName $subscrName

+$locName=(Get-AzResourceGroup -Name $rgName).Location

+# Create an availability set for SQL Server virtual machines

+New-AzAvailabilitySet -ResourceGroupName $rgName -Name sqlAvailabilitySet -Location $locName -Sku Aligned -PlatformUpdateDomainCount 5 -PlatformFaultDomainCount 2

+# Create the SQL Server virtual machine

+$vmName="sqlVM"

+$vmSize="Standard_D3_V2"

+$vnet=Get-AzVirtualNetwork -Name "SP2016Vnet" -ResourceGroupName $rgName

+$pip=New-AzPublicIpAddress -Name ($vmName + "-PIP") -ResourceGroupName $rgName -Location $locName -AllocationMethod Dynamic

+$nic=New-AzNetworkInterface -Name ($vmName + "-NIC") -ResourceGroupName $rgName -Location $locName -SubnetId $vnet.Subnets[0].Id -PublicIpAddressId $pip.Id -PrivateIpAddress "10.0.0.5"

+$avSet=Get-AzAvailabilitySet -Name sqlAvailabilitySet -ResourceGroupName $rgName

+$vm=New-AzVMConfig -VMName $vmName -VMSize $vmSize -AvailabilitySetId $avSet.Id

+$vm=Set-AzVMOSDisk -VM $vm -Name ($vmName +"-OS") -DiskSizeInGB 128 -CreateOption FromImage -StorageAccountType "Standard_LRS"

+$diskSize=100

+$diskConfig=New-AzDiskConfig -AccountType "Standard_LRS" -Location $locName -CreateOption Empty -DiskSizeGB $diskSize

+$dataDisk1=New-AzDisk -DiskName ($vmName + "-SQLData") -Disk $diskConfig -ResourceGroupName $rgName

+$vm=Add-AzVMDataDisk -VM $vm -Name ($vmName + "-SQLData") -CreateOption Attach -ManagedDiskId $dataDisk1.Id -Lun 1

+$cred=Get-Credential -Message "Type the name and password of the local administrator account of the SQL Server computer."

+$vm=Set-AzVMOperatingSystem -VM $vm -Windows -ComputerName $vmName -Credential $cred -ProvisionVMAgent -EnableAutoUpdate

+$vm=Set-AzVMSourceImage -VM $vm -PublisherName MicrosoftSQLServer -Offer SQL2014SP3-WS2012R2 -Skus Standard -Version "latest"

+$vm=Add-AzVMNetworkInterface -VM $vm -Id $nic.Id

+New-AzVM -ResourceGroupName $rgName -Location $locName -VM $vm

+```

+> [!NOTE]

+> This PowerShell command set creates an Azure availability set for the sqlVM virtual machine. This is done in case you want to add more SQL Server virtual machines to this basic configuration.

+

+From the [Azure portal](https://portal.azure.com), connect to the SQL Server virtual machine (sqlVM) using the credentials of the local administrator account.

+

+Next, join the SQL Server to the Windows Server AD domain with these commands at an administrator-level Windows PowerShell command prompt on sqlVM.

+

+```

+Add-Computer -DomainName "corp.contoso.com"

+Restart-Computer

+```

+Note that you must supply domain account credentials after entering the **Add-Computer** command. Use the CORP\\<ADMIN_NAME> account and password.

+

+After the SQL Server virtual machine restarts, reconnect to it using the credentials of the local administrator account.

+

+Next, add an extra data disk as a new volume with the drive letter F: and create folders with these commands at an administrator-level Windows PowerShell command prompt on sqlVM.

+

+```

+Get-Disk | Where PartitionStyle -eq "RAW" | Initialize-Disk -PartitionStyle GPT -PassThru | New-Partition -AssignDriveLetter -UseMaximumSize | Format-Volume -FileSystem NTFS -NewFileSystemLabel "SQL Data"

+md f:\Data

+md f:\Log

+md f:\Backup

+```

+Next, configure the SQL server to use the F: drive for new databases and for accounts and permissions.

+

+1. On the Start screen, type **SQL Studio**, and then click **SQL Server 2014 Management Studio**.

+

+2. In **Connect to Server**, click **Connect**.

+

+3. In the left pane, right-click the top nodeΓÇöthe default instance named after the machineΓÇöand then click **Properties**.

+

+4. In **Server Properties**, click **Database Settings**.

+

+5. In **Database default locations**, set the following values:

+

+ - For **Data**, set the path to **f:\Data**.

+

+ - For **Log**, set the path to **f:\Log**.

+

+ - For **Backup**, set the path to **f:\Backup**.

+

+6. Click **OK** to close the window.

+

+7. In the left pane, expand the **Security** folder.

+

+8. Right-click **Logins**, and then click **New login**.

+

+9. In **Login name**, type **CORP**\\<ADMIN_NAME>.

+

+10. Under **Select a page**, click **Server Roles**, click **sysadmin**, and then click **OK**.

+

+11. Close SQL Server 2014 Management Studio.

+

+SQL Server requires a port that clients use to access the database server. It also needs ports to connect with the SQL Server Management Studio. Run the following command at an administrator-level Windows PowerShell command prompt on the SQL Server virtual machine.

+

+```

+New-NetFirewallRule -DisplayName "SQL Server ports 1433, 1434, and 5022" -Direction Inbound -Protocol TCP -LocalPort 1433,1434,5022 -Action Allow

+```

+Sign out as the local administrator.

+

+Here is the result of Phase 2.

+

+

+

+## Phase 3: Add and configure a SharePoint Server virtual machine

+In this phase, you create a SharePoint Server virtual machine in your virtual network, make it a member of the Windows Server AD domain, and then create a new SharePoint farm.

+

+To create the SharePoint Server virtual machine with Azure PowerShell, supply the values of the variables. For the **$dnsName** value, you must determine a globally unique name. Then, run the resulting block at your local Azure PowerShell prompt.

+

+```

+# Set up key variables

+$subscrName="<name of your Azure subscription>"

+$rgName="<your resource group name>"

+$dnsName="<unique, public domain name label for the SharePoint server>"

+# Set the Azure subscription

+Select-AzSubscription -SubscriptionName $subscrName

+# Get the location

+$locName=(Get-AzResourceGroup -Name $rgName).Location

+# Create an availability set for SharePoint virtual machines

+New-AzAvailabilitySet -ResourceGroupName $rgName -Name spAvailabilitySet -Location $locName -Sku Aligned -PlatformUpdateDomainCount 5 -PlatformFaultDomainCount 2

+# Create the spVM virtual machine

+$vmName="spVM"

+$vmSize="Standard_D3_V2"

+$vm=New-AzVMConfig -VMName $vmName -VMSize $vmSize

+$pip=New-AzPublicIpAddress -Name ($vmName + "-PIP") -ResourceGroupName $rgName -DomainNameLabel $dnsName -Location $locName -AllocationMethod Dynamic

+$vnet=Get-AzVirtualNetwork -Name "SP2016Vnet" -ResourceGroupName $rgName

+$nic=New-AzNetworkInterface -Name ($vmName + "-NIC") -ResourceGroupName $rgName -Location $locName -SubnetId $vnet.Subnets[0].Id -PublicIpAddressId $pip.Id -PrivateIpAddress "10.0.0.6"

+$avSet=Get-AzAvailabilitySet -Name spAvailabilitySet -ResourceGroupName $rgName

+$vm=New-AzVMConfig -VMName $vmName -VMSize $vmSize -AvailabilitySetId $avSet.Id

+$vm=Set-AzVMOSDisk -VM $vm -Name ($vmName +"-OS") -DiskSizeInGB 128 -CreateOption FromImage -StorageAccountType "Standard_LRS"

+$cred=Get-Credential -Message "Type the name and password of the local administrator account."

+$vm=Set-AzVMOperatingSystem -VM $vm -Windows -ComputerName $vmName -Credential $cred -ProvisionVMAgent -EnableAutoUpdate

+$vm=Set-AzVMSourceImage -VM $vm -PublisherName "MicrosoftSharePoint" -Offer "MicrosoftSharePointServer" -Skus "sp2016" -Version "latest"

+$vm=Add-AzVMNetworkInterface -VM $vm -Id $nic.Id

+New-AzVM -ResourceGroupName $rgName -Location $locName -VM $vm

+```

+> [!NOTE]

+> This Azure PowerShell command block creates an Azure availability set for the spVM virtual machine. This is done in case you want to add more SharePoint Server virtual machines to this basic configuration.

+

+### Configure the SharePoint Server virtual machine

+Connect to the SharePoint virtual machine (spVM) using the credentials of the local administrator account.

+

+Join the SharePoint virtual machine to the Windows Server AD domain with these commands at an administrator-level Windows PowerShell command prompt on spVM.

+

+```

+Add-Computer -DomainName "corp.contoso.com"

+Restart-Computer

+```

+Note that you must supply domain account credentials after entering the **Add-Computer** command. Use the CORP\\<ADMIN_NAME> account name and password.

+

+After the SharePoint virtual machine restarts, reconnect to it using the CORP\\<ADMIN_NAME\> account name and password.

+

+ **Create a new SharePoint farm**

+

+1. From the Start screen, type **SharePoint**, and then click **SharePoint 2016 Products Configuration Wizard**.

+

+2. On the **Welcome to SharePoint Products** page, click **Next**.

+

+3. A **SharePoint Products Configuration Wizard** dialog appears, warning that services (such as IIS) will be restarted or reset. Click **Yes**.

+

+4. On the **Connect to a server farm** page, select **Create a new server farm**, and then click **Next**.

+

+5. On the **Specify Configuration Database Settings** page:

+

+ - In **Database server**, type **sqlVM**.

+

+ - In **Username**, type **CORP\sp_farm_db**.

+

+ - In **Password**, type the sp_farm_db account password.

+

+6. Click **Next**.

+

+ If the sqlVM server cannot be found, ensure that you ran this command from an administrator-level Windows PowerShell command prompt on sqlVM:

+

+ ```

+ New-NetFirewallRule -DisplayName "SQL Server ports 1433, 1434, and 5022" -Direction Inbound -Protocol TCP -LocalPort 1433,1434,5022 -Action Allow

+ ```

+7. On the **Specify Farm Security Settings** page, type a passphrase twice. Record the passphrase and store it in a secure location for future reference. Click **Next**.

+

+8. On the **Specify Server Role** page, in **Single-Server Farm**, click **Single-Server Farm**, and then click **Next**.

+

+9. On the **Configure SharePoint Central Administration Web Application** page, click **Next**.

+

+10. The **Completing the SharePoint Products Configuration Wizard** page appears. Click **Next**.

+

+11. The **Configuring SharePoint Products** page appears. Wait until the configuration process completes.

+

+12. On the **Configuration Successful** page, click **Finish**. The new administration website starts.

+

+13. On the **Help Make SharePoint Better** page, click your choice to participate in the Customer Experience Improvement Program, and then click **OK**.

+

+14. On the **Welcome** page, click **Start the Wizard**.

+

+15. On the **Service Applications and Services** page, in **Service Account**, click **Use existing managed account**, and then click **Next**. It can take a few minutes to display the next page.

+

+16. On the **Create Site Collection** page, type **Contoso** in **Title**, and then click **OK**.

+

+17. On the **This completes the Farm Configuration Wizard** page, click **Finish**. The SharePoint Central Administration web page displays.

+

+18. Open a new tab in Internet Explorer, type **http://spvm/** in the Address bar, and then press Enter. You should see the default Contoso team site.

+

+Next, you configure an alternate access mapping so that Internet users can access the SharePoint server using the DNS name for the public IP address assigned to the spVM virtual machine.

+

+ **Configure an alternate access mapping**

+

+1. At the Azure PowerShell prompt on your local computer, run the following command:

+

+ ```

+ Write-Host (Get-AzPublicIpaddress -Name "spVM-PIP" -ResourceGroup $rgName).DnsSettings.Fqdn

+ ```

+2. Note the DNS name.

+

+3. On the spVM virtual machine, in Internet Explorer, click the **Home - Central Administration** tab.

+

+4. In the **System Settings** section, click **Configure alternate access mappings**.

+

+5. On the **Alternate Access Mappings** page, click **Edit Public URLs**.

+

+6. On the **Edit Public Zone URLs** page, click the link next to **Alternate Access Mapping Collection**, and then click **Change Alternate Access Mapping Collection**.

+

+7. In **Select An Alternate Access Mapping Collection**, click **SharePoint - 80**.

+

+8. On the **Edit Public Zone URLs** page, in **Internet**, type **http://**<the DNS name from step 2>, and then click **Save**.

+

+Here is the result of Phase 3.

+

+

+

+From a browser on your local computer, access **http://**\<DNS name of the spVM virtual machine>. When prompted from credentials, use the CORP\\<ADMIN_NAME> account name and password. You should see the default Contoso team site.

+

+## Next steps

+When you are ready to design a production SharePoint Server farm in Azure, see [Designing a SharePoint Server farm in Azure](designing-a-sharepoint-server-farm-in-azure.md).

+

+When you are ready to deploy a production-ready, high availability SharePoint Server 2016 farm in Azure, see [Deploying SharePoint Server with SQL Server AlwaysOn Availability Groups in Azure](deploying-sharepoint-server-with-sql-server-alwayson-availability-groups-in.md).

+To start developing Low or High Trust Addins, you must first configure an App Domain. See [Configure an environment for apps for SharePoint Server](configure-an-environment-for-apps-for-sharepoint.md).

+

+## Stop and start the virtual machines in the farm

+Azure virtual machines incur an ongoing cost when they are running. To help minimize the cost of your SharePoint Server dev/test environment, use these commands to stop the virtual machines:

+

+```

+$rgName="<your resource group name>"

+Stop-AzVM -Name spVM -ResourceGroupName $rgName -Force

+Stop-AzVM -Name sqlVM -ResourceGroupName $rgName -Force

+Stop-AzVM -Name adVM -ResourceGroupName $rgName -Force

+```

+To start them again, use these commands:

+

+```

+$rgName="<your resource group name>"

+Start-AzVM -Name adVM -ResourceGroupName $rgName

+Start-AzVM -Name sqlVM -ResourceGroupName $rgName

+Start-AzVM -Name spVM -ResourceGroupName $rgName

+```

+## See also

+#### Concepts

+[SharePoint Server](../sharepoint-server.yml)

+

+[Install SharePoint Server](../install/install.md)

+#### Other Resources

+[Designing a SharePoint Server farm in Azure](designing-a-sharepoint-server-farm-in-azure.md)

+

+[Deploying SharePoint Server with SQL Server AlwaysOn Availability Groups in Azure](deploying-sharepoint-server-with-sql-server-alwayson-availability-groups-in.md)

+[Cloud adoption Test Lab Guides (TLGs)](/office365/enterprise/cloud-adoption-test-lab-guides-tlgs)

+ Title: "SharePoint Server in Microsoft Azure"

+audience: ITPro

+f1.keywords:

+- CSH

+ms.localizationpriority: medium

+- IT_Sharepoint_Server

+- IT_Sharepoint_Server_Top

+- IT_Sharepoint16

+- Strat_O365_Enterprise

+- Ent_Solutions

+ms.assetid: 8da53a30-27f2-4297-95c2-54eff999e863

+description: "Find out why Microsoft Azure is the best place to host your SharePoint Server 2016 farms in the cloud."

+# SharePoint Server in Microsoft Azure

+

+To realize the productivity and collaboration benefits of SharePoint, Microsoft recommends SharePoint in Microsoft 365. If SharePoint in Microsoft 365 is not the best option for you right now, you can deploy SharePoint Server 2016 on intranet servers, which can be in your on-premises datacenter or hosted in Microsoft Azure infrastructure services. Whether it's for development, testing, staging, production, or disaster recovery purposes, Azure is a perfect home for your SharePoint farms in the cloud.

+

+Here are some of the benefits:

+

+- You can deploy a SharePoint Server farm rapidly and scale it up or down as needed.

+

+ You can create the infrastructure for your SharePoint servers very quickly using multiple tools and methods. Set up development or test farms or scale out your production SharePoint deployments by adding more resources. Simplify deployment and configuration with ready-to-deploy images and reduce the time to deploy complex SharePoint farms from days to hours.

+

+- You can host your SharePoint Server farm cost-effectively.

+

+ Pay-as-you-go pricing for server and storage capacity and per-minute billing from Azure helps you save money. When performing application or performance testing, create additional servers as needed for scale and load testing over short periods of time and remove them when you're finished. Using and paying for only the resources that you needΓÇöand no moreΓÇöhelps you reduce costs.

+

+- You can seamlessly move virtual machines between on-premises and Azure.

+

+ A virtual machine in Azure running Windows or SQL Server is no different than a server running in an on-premises datacenter. You can easily move virtual machines between on-premises physical servers or servers at your hosting provider and Azure to:

+

+ - Quickly and easily replicate your SharePoint Server dev-test environments or secondary production sites in Azure.

+

+ - Move them back on-premises when the need arises.

+

+- You can run your Microsoft applications where they run best.

+

+ Choosing Azure to host your SharePoint Server farms is a safe bet on the cloud that was built by the same company that built SharePoint and SQL Server. These applications have been battle-tested to perform well on Azure. Use your existing licenses with license mobility and the Azure Hybrid Use Benefit, and get first-class, first-party support across Azure, SharePoint, and SQL Server. Running your SharePoint Server farms on Azure ensures your solution is running on the same cloud framework that hosts Microsoft 365 and Microsoft Dynamics 365.

+

+## Proof of concept

+To get your hands on SharePoint Server farm in Azure infrastructure services, see these dev/test environments:

+

+- To create a single-server farm running in Azure for demonstration, evaluation, or application testing, see [Single-server SharePoint Server farm in Azure](sharepoint-server-dev-test-environment-in-azure.md).

+

+ 

+

+- To simulate the user experience and administration of an intranet SharePoint Server farm running in Azure, see [Intranet SharePoint Server in Azure dev/test environment](intranet-sharepoint-server-in-azure-dev-test-environment.md).

+

+ 

+

+## Design and planning

+ To design the elements of Azure infrastructure services to host a custom dev/test environment, a production farm, or a disaster recovery farm, see [Designing a SharePoint Server farm in Azure](designing-a-sharepoint-server-farm-in-azure.md).

+

+## Deployment

+See [Deploying SharePoint Server with SQL Server AlwaysOn Availability Groups in Azure](deploying-sharepoint-server-with-sql-server-alwayson-availability-groups-in.md) for step-by-step instructions on how to build out this high-availability intranet production farm in Azure.

+

+

+

+## See also

+[SharePoint Server](../sharepoint-server.yml)

+

+[Install SharePoint Server](../install/install.md)

+ Title: "Use a sample MIM solution in SharePoint Server"

+audience: ITPro

+f1.keywords:

+- NOCSH

+ms.localizationpriority: medium

+- IT_Sharepoint_Server

+- IT_Sharepoint_Server_Top

+ms.assetid: b4c2dace-97fc-43c7-8991-44279a4fe05d

+description: "How to configure SharePoint Server profile synchronization with Microsoft Identity Manager (MIM)."

+# Use a sample MIM solution in SharePoint Server

+

+The article outlines a solution that will help you to install and synchronize accounts to SharePoint Server using Microsoft Identity Management, or MIM. MIM 2016 is the successor to a profile synchronization technology leveraged by previous versions of SharePoint Server that was known as Forefront Identity Manager, or FIM. FIM is no longer included as part of the product from SharePoint Server 2016. However, MIM is not the only synchronization solution that SharePoint Server offers. If you would prefer to use the Active Directory Direct Import that is built-in with SharePoint Server, please see the configuration article [here](./configure-profile-synchronization-by-using-sharepoint-active-directory-import.md). Otherwise, follow the steps in this article to configure a new installation of MIM for your User Profile Synchronization.

+

+- [Download the solutions files that you need](#download-the-solutions-files-that-you-need)

+

+- [Gather the configuration details you need](#gather-the-configuration-details-you-need)

+

+- [The Microsoft PowerShell to install the SharePoint Server Synchronization Configuration file](#the-microsoft-powershell-to-install-the-sharepoint-server-synchronization-configuration-file)

+

+- [The Microsoft PowerShell to start the SharePoint Synchronization Configuration](#the-microsoft-powershell-to-start-the-sharepoint-synchronization-configuration)

+

+> [!IMPORTANT]

+> The solutions files referenced in this article are available for download [here](https://github.com/OfficeDev/PnP-Tools/tree/master/Solutions/UserProfile.MIMSync). You will need a GitHub account for access. See the section 'Download the solutions files that you need' for more details. > Microsoft Identity Manager 2016 is available for download from the [Microsoft Volume Licensing Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx). (Log in and search on the product name.) > On your MIM server, be sure to install Service Pack 1 (https://aka.ms/mim2016sp1upgrade).

+

+## Download the solutions files that you need

+<a name="BKMK_Download"> </a>

+Download the files used by this solution into a folder on SharePoint Server. Make certain you're logged in as a Farm Administrator and have a local administrator rights on this server.

+

+1. **SharePointSync.psm1** - Microsoft PowerShell module for deploying and starting the synchronization solution.

+

+2. **MA-AD.xml** - This is the MIM management agent for Active Directory.

+

+3. **MA-SP.xml** - This is the MIM management agent for SharePoint Server.

+

+4. **MV.xml** - This XML file contains additional User Profile Synchronization configuration.

+

+## Gather the configuration details you need

+<a name="BKMK_Gather"> </a>

+To run the Microsoft PowerShell commands involved in this solution, you'll need to catalog some information from your Active Directory and your SharePoint Server configuration as well. You should include this information in any build-documentation you keep on the User Profile Synchronization process.

+

+**Active Directory**

+|**Item**|**Description**|

+|:--|:--|

+|ForestDnsName <br/> |This is the DNS name of the Active Directory forest to be synchronized. <br/> |

+|ForestCredential <br/> |This is the username and password of the account that will be used to read objects from Active Directory. This account must have Replicate-Directory-Changes permissions in the Active Directory that is to be synchronized. <br/> |

+|OrganizationalUnit <br/> |This is the distinguished name of the Active Directory container to be synchronized. You can add more containers after the configuration is loaded. To add more containers, use the Synchronization Service Manager GUI interface to modify the 'AD' management agent. <br/> |

+

+**SharePoint Connection Details**

+|**Item**|**Description**|

+|:--|:--|

+|SharePointUrl <br/> |This is the URL of the SharePoint Server running the User Profile Service application, for example, http://SharePoint01:8080. <br/> |

+|SharePointCredential <br/> |The username and password of the account used to read and write objects into the SharePoint User Profile. <br/> |

+

+## The Microsoft PowerShell to install the SharePoint Server Synchronization Configuration file

+<a name="BKMK_InstallConfigfile"> </a>

+Once you've downloaded the solution files and cataloged the configuration details you can begin running the Microsoft PowerShell command for installing the SharePoint Synchronization Configuration.

+

+The configuration is installed by loading SharePointSync.psm1 and calling Install-SharePointSyncConfiguration as shown in the following code.

+

+```XML

+### Load the SharePoint Sync Module

+Import-Module C:\SharePointSync\SharePointSync.psm1 -Force

+### Install the SharePoint Sync Configuration

+Install-SharePointSyncConfiguration `

+ -Path C:\SharePointSync `

+ -ForestDnsName litware.ca `

+ -ForestCredential (Get-Credential LITWARE\adSyncAccount) `

+ -OrganizationalUnit 'ou=Litwarians,dc=Litware,dc=ca' `

+ -SharePointUrl http://SharePointServer:5555 `

+ -SharePointCredential (Get-Credential LITWARE\spUserProfileAdmin) `

+ -Verbose

+```

+## Preview the impact of your SharePoint Synchronization

+<a name="BKMK_InstallConfigfile"> </a>

+Once the synchronization configuration is installed, it's ready to be started. Before you make further changes, you can examine the impact your synchronization will have by running the Start-SharePointSync cmdlet with '-WhatIf'.

+

+```XML

+### Run the Synchronization Service management agents

+Start-SharePointSync -WhatIf -Verbose

+```

+

+

+## The Microsoft PowerShell to start the SharePoint Synchronization Configuration

+<a name="BKMK_StartSyncConfig"> </a>

+To start the SharePoint Server synchronization service on-demand, run the Start-SharePointSync cmdlet.

+

+```XML

+### Run the Synchronization Service management agents

+Start-SharePointSync -Verbose

+```

+

+

+## How to add more Active Directory Domains

+<a name="BKMK_StartSyncConfig"> </a>

+Now that you've loaded the initial configuration, you can add more domains for synchronization. Follow these steps in the Synchronization Service manager.

+

+ **1. Add another domain or domains**

+

+1. Open the Synchronization Service Manager.

+

+2. In the Management Agents tab, select the ADMA management agent > **Properties** > **Actions**.

+

+3. In the **Properties** dialog > **Configure Directory Partitions**.

+

+4. In the list of directory partitions, select any domain you want to synchronize (and remember that credentials for these domains may be required).

+

+5. Click **OK** to save the management agent properties.

+

+Each run profile for the ADMA management agent must be updated for each domain that was added. To update your profiles do the following:

+

+ **2. Update your run profile**

+

+1. In the **Management Agents** tab > select **ADMA Management** agent > select **Configure Run Profiles**.

+

+2. Select **FullImport** run profile > New Step.

+

+3. Choose a step type of **Full Import (Stage Only)** > **Next**.

+

+4. Choose the partition that matches the domain you just added and click **Finish**. The run profile should now have two steps.

+

+5. Select the **FullSync** run profile next > New Step.

+

+6. Choose a step type of **Full Synchronization** > **Next**.

+

+7. Choose the partition that matches the domain you just added > **Finish**. The Run profile will now have two steps.

+

+8. Click **DeltaImport** in the run profiles next > New Step.

+

+9. Choose a step of type **Delta Import (Stage Only)** > **Next**.

+

+10. Choose the partition that matches the domain that was just added > **Finish**. The run profile should now have two steps.

+

+11. Select the **DeltaSync** run profile > **New Step**.

+

+12. Choose a step of type **Delta Synchronization** > **Next**.

+

+13. Choose the partition that matches the domain that was just added > **Finish**. The run profile should now have two steps.

+

+14. Click **Apply** to save all the run profile changes > **OK**.

+(You can also [customize your SharePoint Server app launcher separately](../administration/custom-tiles-in-sharepoint-server.md).)

+**APPLIES TO:** 2013 2016 2019 SharePoint in Microsoft 365

+**APPLIES TO:** 2013 2016 2019 Subscription Edition SharePoint in Microsoft 365

+**APPLIES TO:** 2013 2016 2019 Subscription Edition SharePoint in Microsoft 365

+**APPLIES TO:** 2013 2016 2019 SharePoint in Microsoft 365

+**APPLIES TO:** 2013 2016 2019 SharePoint in Microsoft 365

+**APPLIES TO:** 2013 2016 2019 Subscription Edition SharePoint in Microsoft 365

+**APPLIES TO:** 2013 2016 2019 SharePoint in Microsoft 365

+**APPLIES TO:** 2013 2016 2019 Subscription Edition SharePoint in Microsoft 365

+**APPLIES TO:** 2013 2016 2019 SharePoint in Microsoft 365

+**APPLIES TO:** 2013 2016 2019 Subscription Edition SharePoint in Microsoft 365

+**APPLIES TO:** 2013 2016 2019 Subscription Edition SharePoint in Microsoft 365

+**APPLIES TO:** 2013 2016 2019 SharePoint in Microsoft 365

+**APPLIES TO:** 2013 2016 2019 Subscription Edition SharePoint in Microsoft 365

+**APPLIES TO:** 2013 2016 2019 SharePoint in Microsoft 365

+**APPLIES TO:** 2013 2016 2019 Subscription Edition SharePoint in Microsoft 365

+**APPLIES TO:** 2013 2016 2019 Subscription Edition SharePoint in Microsoft 365

+**APPLIES TO:** 2013 2016 2019 SharePoint in Microsoft 365

+**APPLIES TO:** 2013 2016 2019 Subscription Edition SharePoint in Microsoft 365

+**APPLIES TO:** 2013 2016 2019 Subscription Edition SharePoint in Microsoft 365

+**APPLIES TO:** 2013 2016 2019 Subscription Edition SharePoint in Microsoft 365

+|[Custom Tiles in SharePoint Server](../administration/custom-tiles-in-sharepoint-server.md) <br/> |Describes Custom Tiles, one of the new features in the November 2016 Public Update for SharePoint Server 2016 (Feature Pack 1). <br/> |

+|[SharePoint Server in Microsoft Azure](../administration/sharepoint-server-in-microsoft-azure.md) <br/> |Learn about why Microsoft Azure is the best place to host your SharePoint Server 2016 farms in the cloud. <br/> |

+|[Microsoft Identity Manager in SharePoint Server](../administration/microsoft-identity-manager-in-sharepoint-server.md) <br/> |Learn about the Microsoft Identity Manager (MIM) in SharePoint Servers 2016 and 2019 and the features it provides to you as an external identity manager. <br/> |

+- By using Microsoft Identity Manager (MIM). To utilize MIM, see [Microsoft Identity Manager in SharePoint Servers](../administration/microsoft-identity-manager-in-sharepoint-server.md#microsoft-identity-manager-in-sharepoint-server).

+|XLLinkedWkbkCoun]t|Decimal|No|No|No|Yes|No|No|XLLinkedWkbkCount||

+|**SharePoint Custom Tiles** <br/> |SharePoint admins can now add SharePoint and Microsoft 365 workloads as custom tiles in SharePoint app launcher. <br/> |For more info, see [Custom Tiles in SharePoint Server](../administration/custom-tiles-in-sharepoint-server.md). <br/> |