Managing Federation

After enabling user accounts for federation, administrators can manage the organizations with which they want to federate through Lync Server. If partner discovery lookups are allowed on the Access Edge configuration, all domains are automatically allowed. Adding allowed domains can still be done to grant a higher level of trust to partners, but is not required. If partner discovery is not allowed, administrators must manually add all federated partners to the allow list.

Blocking a federated domain can be used to prevent internal users from communicating with specific partners. This is used in situations in which federation should be allowed globally, but blocked to only a few specific domain names. To allow or block a federated domain, use the following steps:

1. Open the Lync Server Control Panel.

2. Select Federation and External User Access in the navigation pane.

3. Click SIP Federated Domains.

4. Click New and then select either Allowed Domain or Blocked Domain.

5. Enter the SIP domain name of the federated domain allowed or blocked, as shown in Figure 6.6, and click OK.

Figure 6.6. Adding an allowed domain for SIP federation.

The Lync Server Management Shell can also be used to perform these tasks. To allow a new domain, use the following command. The only required parameter is the domain name, but a comment and partner’s Access Edge Server FQDN can also be specified. In addition, the MarkForMonitoring parameter can be set to enable quality monitoring to this domain by a Monitoring Server role.

New-CSAllowedDomain –Domain <SIP Domain Name> -Comment <Comment string> -ProxyFQDN <Partner Access Edge FQDN> -MarkForMonitoring <True|False>

To block a domain from sending or receiving messages, use the following command:

New-CSBlockedDomain –Domain <SIP Domain Name>