Change Management for Enterprises

Dedicated Plans Service Description

Published: October 2011

The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. 2011 Microsoft Corporation. All rights reserved. Microsoft, Active Directory, ActiveSync, Lync, Outlook, and SharePoint are trademarks of the Microsoft group of companies. All other trademarks are property of their respective owners.

Change Management for Enterprises Service Description (Dedicated Plans) | October 2011

Contents
Introduction ........................................................................................................................................................ 4 Change Management Process .......................................................................................................................... 5 Request for Change Process....................................................................................................................................................... 5 Change Windows ............................................................................................................................................................................ 5 Change Window Details ............................................................................................................................................................ 5 Microsoft Change Notifications to Customers .................................................................................................................... 6 Customer Change Notifications to Microsoft ...................................................................................................................... 6 Engaging Microsoft to Implement Changes .................................................................................................. 8 Design or Service Changes ......................................................................................................................................................... 8 Onsite Assistance for Customer Co-Located Equipment ................................................................................................ 8 Emergency Changes in the Customer Environment ......................................................................................................... 9

Change Management for Enterprises Service Description (Dedicated Plans) | October 2011

Introduction
The Microsoft Office 365 change management team directs the process and procedures related to approval, scheduling, testing, and deployment of changes in the pre-production and production Office 365 infrastructure environments. The approach used in this service management function is built on the Information Technology Infrastructure Library (ITIL) and Microsoft Operations Framework (MOF) standards, which aligns with the change management process in most customer organizations. This document describes the change management practices that Microsoft has adopted for Office 365 services provided under its dedicated subscription plans.* It specifically applies to the following service offerings: Microsoft Exchange Online Microsoft SharePoint Online Microsoft Lync Online

* Office 365 for enterprises dedicated plans are delivered from a Microsoft hosting environment where each customer has their own dedicated data center hardware.

Change Management for Enterprises Service Description (Dedicated Plans) | October 2011

Change Management Process

The production environment for Microsoft Office 365 is periodically subject to modifications due to requirements for maintenance, security patches, customer-requested Microsoft SharePoint Online configuration changes, and other factors. Implementing these changes may affect one or more of the Office 365 services that are provided to the customer. The purpose of the Office 365 change management team is to direct the change process in an efficient and effective manner.

Request for Change Process

The change management process is driven by the Request for Change (RFC) process. Requests for change address issues that affect the production environmentas opposed to design change requests, which affect product design or functionality. The change management process begins by submitting an RFC using the Microsoft RFC tool. Through a series of decision matrices, the request is classified as having a low, medium, or high impact to the availability, stability, or security of the service. If the request is classified as a known change type that is either auto-approved or functionally approved, the request is not reviewed by the Change Advisory Board (CAB) or the Emergency Change Advisory Board and is deployed to production as appropriate. Any change that is classified as having a known or high-risk impact to one of the services provided by Office 365 is reviewed by the Change Advisory Board or the Emergency Change Advisory Board. If the board authorizes the change, it is scheduled for deployment during an Office 365 change window. The customer is notified five (5) business days in advance of the deployment via the Forward Schedule of Change (FSC) notification process.

Change Windows
A change window is defined as a period of time when Microsoft deploys changes that carry a high risk of impacting, or are known to impact, Office 365 service offerings. There are two types of change windows: pre-established maintenance change windows that are treated as scheduled downtime for service-level agreement (SLA) purposes, and emergency change windows that must occasionally be implemented. The Office 365 change management team coordinates with the customer to determine a change window schedule that has minimal business impact to the customers usersusually once a week for the duration of one eight-hour working shift. The realized service downtime will be much shorter in duration than the length of the entire window, typically less than 10 minutes intermittently throughout the window while servers are rebooted or clusters are failed over. As stated above, any service downtime that is incurred during a pre-established maintenance window is removed from service-level agreement (SLA) reporting. If a service is impacted beyond the communicated window, the Office 365 incident management process is initiated, and the customer is provided with the appropriate communication.

Change Window Details

Microsoft Office 365 uses the following change windows: Pre-established maintenance windows (scheduled downtime) o Maintenance window: Changes that are implemented during the maintenance window have a high risk of impacting, or are known to impact, Office 365 service offerings that are subscribed to by a customer.
Change Management for Enterprises Service Description (Dedicated Plans) | October 2011 5

SharePoint Online customization window: Customers have two windows each month to deploy the SharePoint Online customizations and configuration changes that they have requested. These changes are scheduled for implementation on designated Fridays during the customers off-business hours so that the customer can avoid conflicts with the maintenance window changes.

Emergency windows o Emergency patch window: The Microsoft Security Response Center (MSRC) releases security bulletins on the second Tuesday of every month ( Patch Tuesday), or as appropriate to mitigate zero-day exploits. In the event that proof-of-concept code is publicly available regarding a possible exploit, or if a new critical security patch is released, Microsoft is required to apply patches to affected Office 365 systems as soon as possible to immediately remediate the vulnerability to the customers hosted environment. During this window, the Office 365 operations team updates or patches all applicable Office 365 systems, which can result in a brief interruption of services, typically less than 10 minutes, while servers are rebooted or clusters are failed over. Emergency downtime window: In the event that an emergency change is necessary to stabilize or secure a Office 365 hosted environment, the emergency downtime window process is initiated. The customers IT representatives are notified prior to the change occurring. During this window, the realized downtime to the customer services is minimized to the time it takes to reboot a server or to fail over a clustertypically less than 10 minutesto mitigate the emergency situation.

Microsoft implements high-risk and known Office 365 service-affecting changes during change windows to minimize the service impact to customer organizations. All measures are taken to reduce any service disruptions to the time it takes for a server to reboot or for a cluster to fail over, which is typically less than 10 minutes.

Microsoft Change Notifications to Customers

Every week the Office 365 change management team sends the customers change management team via the customer-owned and managed email distribution lista Forward Schedule of Change (FSC) notification. The FSC notification describes the high-level details and end-user impact of the approved changes that are scheduled for implementation in the customers hosted environment during the upcoming change window(s). This FSC notification process provides a minimum of five (5) business days advance notice of planned service-impacting change activity and recaps the changes scheduled for implementation in the upcoming change window.

Customer Change Notifications to Microsoft

The Office 365 change management team requests that the customers change management team send an FSC notification to the Office 365 change management team that outlines any planned change activity in the customers environment that has a potential of impacting an Office 365 service that Microsoft provides to the customer. The notification should provide the associated details of those changes, as understood by the customer.

Change Management for Enterprises Service Description (Dedicated Plans) | October 2011

All change activity in the customer environment that is related tobut not limited tothe following items should be communicated between the Office 365 change management team and the customers change management team no later than three (3) business days prior to implementation. General Internally published change freeze calendars that the customer wants Microsoft to honor (for example, for financial processing or global deployments). Public and internal Domain Name System (DNS) records for Microsoft. Changes to the IP address or server name of internal DNS servers that Microsoft directs its DNS servers to for DNS name resolution within the Customer Network. IP address or server name changes to the customers internal domain control lers and that Microsoft directs its domain controllers to for authentication. Retiring, renaming, or reassigning of the IP address of the domain controllers in the customers preferred domain controller list. Patching or upgrading of co-located domain controllers in the Microsoft data centers. Group Policy changes that modify the behavior of the browser settings for a customers users. Changes in the security policy regarding service and test accounts that have been assigned to Microsoft (for example, password complexity or reset period). Firewall rules for connecting to Office 365 services. Deletion of a domain trust.

Network All point-of-presence devices that connect to Office 365 or the Internet. All customer organization core infrastructure devices.

Microsoft Exchange Online All changes to the customers messaging environment during the migration phase (for example, patching, upgrades, or hotfixes). Patching, upgrading, or rebooting of any mail server (for example, Microsoft Exchange Server, Lotus, GroupWise) that acts as a bridgehead in the Microsoft Exchange Online topology. Decommissioning of any messaging server. Deploying add-ins for the Microsoft Office Outlook messaging and collaboration client to users.

Change Management for Enterprises Service Description (Dedicated Plans) | October 2011

Engaging Microsoft to Implement Changes

Microsoft has an engagement model for changes that are proposed by Office 365 customers, and that are outside normal day-to-day operations and maintenance activities. These proposed changes may be either proactive or reactive (or both). The engagement model for customer-proposed changes is described in the sections that follow.

Design or Service Changes

Customer proposals for a significant modification or alteration to agreed, contractually bound solution architectures, designs, or service packages must be reviewed and approved through established Microsoft channels. Those change proposals that may degrade Office 365 service performance, affect the ability of either Microsoft or the customer organization to meet operating-level agreement (OLA) and service-level agreement (SLA) commitments, or affect obligations concerning the cost of goods sold. Generally, Microsoft strictly manages changes by minimizing one-time requests from customers and focusing on new features that can provide benefits to all customers. To evaluate, manage, and implement customer change requests, Microsoft uses the well-defined processes set forth in the Customer Request Analysis System (CRAS). Customers should contact their Office 365 resource to obtain supporting documents that describe CRAS. CRAS is not used for customer break-fix issues or issues that affect any Office 365 service offerings. Any issue that has an impact on an Office 365 service offering should be managed through standard support escalation processes.

Onsite Assistance for Customer Co-Located Equipment

Co-located equipment is defined as customer-owned and managed assets (hardware or software) that are located within Microsoft managed facilities or at Microsoft leased spaces in third-party managed facilities. The customer or customers carrier is responsible for monitoring their co -located equipment and responding to events and incidents. Microsoft anticipates that from time to time an event will occur that requires physical access to customer-owned co-located hardware in order to make a repair that cannot be made remotely by the customer. In such an event that remote hands services or direct access is required, the customers authorized contact should contact the Microsoft service desk at any time (24 hours a day, 7 days a week) to initiate the physical access process. Some hardware issues can be addressed by remote hands work without the need for the customer to send someone onsite. For example, a Microsoft technician may be able to repair simple hardware issues that do not require being logged on the server such as rack and unrack a device, change out a failed drive, run and remove cable, connect and disconnect a device, or power cycle a device. For issues that cannot be addressed remotely or with remote hands, the customer must submit an escalation request to Microsoft for the customers vendor or carrier to gain access to the site. After the request is received, Microsoft requires no additional information. The customers contact will have access to the site if they report within the specified window of time with a valid government ID. The customer should address all follow-up requests for information regarding work completed directly to the carrier or vender who performed the work.

Change Management for Enterprises Service Description (Dedicated Plans) | October 2011

Emergency Changes in the Customer Environment

If an emergency or non-communicated change in the customers corporate environment affects the availability of or connectivity to an Office 365 service that is hosted by Microsoft, the customer should engage the Microsoft service desk by email (if available) or phone as soon as possible; the service desk is available 24 hours a day, 7 days a week.

Change Management for Enterprises Service Description (Dedicated Plans) | October 2011