SharePoint Online Geo-Replication SPO/O365

Geo-replication/Multi-tenancy

In 2018, I outlined the state of Multi-geo on O365. The easier parts of Geo-Replication are already well handled, and the changes are discussed in the link.  This post focuses on SSO options today and the likely roadmap.

O365 is moving towards multi-tenancy, which will allow multinational companies to store data in compliance with country rules.  For instance, EU data may not be allowed to be stored outside the EU, but you already have your O365 tenancy based in the US.

Historically, most larger companies have chosen either the US or the EU to base their data storage in.  If you wanted data to be stored in another region, you had to buy another tenant, which Microsoft strongly discouraged.

Microsoft are working towards supporting O365 in multiple geo-locations.  Basically, there are 2 parts: 1) User-specific data (email, OneDrive), where we know where a user is based and their data is encrypted and stored in that country. and 2) group/team/country-specific data (SharePoint), where the data itself may have residency rules.

This post examines SharePoint data that must be stored in a specific country.

Options today:
1. On-Prem. Maintaining a SharePoint farm in each geo location requires careful consideration of SSO, Search, MMS, Content Types, and UPA.
2. O365: Have multiple tenants (none are connected) in each location and connect your authentication to each tenant.  The problem with option 2 is that each O365 tenant requires a separate Azure Active Directory.  This means that you will need to hook each O365 tenant up to a single MMS, Search service and poly-fill in the SSO process.  Imagine having 8 regional tenants for regulatory purposes.  To achieve SSO, you will need to create a central AAD and then connect each regional AAD to it.  Azure Directory Sync is required for inviting members and guests, but integrating other companies' AAD can become an issue.  The image below outlines a possible pattern to solve this complex problem.

Coming Q1 2019: Multi-Geo tenant, that shall be the answer.  A lot of the multi-tenant is still in preview, so I shall be interested to see multi-geo tenancy when it goes into General Availability (GA) next year (+-Feb/March 2019).

MSIgnite tour London updates 27-Feb-19:

Brent Alinger

Sovereign geos:

• US Gov
• China (21Vianet)
• Germany

New geos: South Africa, UAE, Norway, O365 data regions coming soon.  See office.com/datamaps

UK: Cardiff, London, and Durham are 3 data centres in the UK.

Note: some services, such as AAD, planner, Yammer, and Sway, are not UK-based, but either Europe or US-based.

The US has 8 data centres.

Can get the default region moved, it’s difficult.

Phase 1: OneDrive and Exchange, April 2018 delivered

Phase 2: O365groups and SharePoint private preview, Oct 2018.  Good feedback so far.  Keen ferry, Cott dimension data.

Multi-geo is not for solving:

• GDPR
• PERFORMANCE enhancer - instead align with MS Global Network
• Pining data to a specific country

Cost:  $2 per month extra per user in satellite locations. Go through the account manager to set it up.  Once approved, it appears in the admin centre and is provisioned within 30 days, although the actual provisioning time can vary between 2 and 30 days.

Need a domain name per geo location for OneDrive and SPO, e.g. https://emeia-radimaging.sharepoint.com

Preferred Data Location (PDL) - used to specify in AAD to show where a user is stored, not for a travelling user, but for a long-term office assignment.  Users of Exchange Online are seamlessly moved.  ODfB requires a PS cod to move the user data.  

Phase 2: SPO March into GA by 30 March 2019 confirmed.  DLP per satellite geo.  Hub sites can span multiple geos.  

Aka.ms/multi-geo

Update: 2020-06-30.  Multi-geo is available in:

1. Australia, 
2. Asia Pacific, 
3. Canada, 
4. European Union, 
5. France, 
6. India, 
7. Japan, 
8. Korea, 
9. United Kingdom, 
10. United States, 
11. United Arab Emirates, 
12. South Africa, and 
13. Switzerland.

Geo-replication in SharePoint and SPO to the rescue

Geo-Replication on SharePoint (Not covering email or OneDrive)

Problem: Over the past 7 years, I have worked on a few clients that require some form of Geo-Replication of share SharePoint farms.  Geo-replication is normally needed for compliance.  This post assumes you need to geo-replicate and not why you need to geo-replicate

Tip: Geo-replication can be used for performance but the complexity that it brings I feel is an added bonus and should not be undertaken for performance gains, there are easier better pragmatic answers to performance such as Riverbed devices, caching and CDN's to name a few.

Initial Hypothesis:  Large organisations existing in multiple geographic regions and need to abide by country regulations and often other industry standards bring the need to geo-replication capability.  I recently completed several high profile projects for a big four consultancy that needed to ensure SharePoint data does not leave its jurisdiction depending on its metadata.  Building on-prem SharePoint farms were extremely complex and the 3 big services that needed to be centralized or copied are Search, MMS and the Content Type Hub.  There are more like AAD but for my situation, I needed to be able to have multiple SharePoint farms in specific regions that connected to centralised services.

Thoughts: MS has OneDrive and the email piece working in local geographies.
SharePoint is coming with multi-tenancy and users will get unified search results across geographic regions.

1. Search each tenant holds their own index, not a central index for search - "good news for data location compliance".  Somehow MS are intermingling all the search results using federation - so they appear as an ordered result set from multiple different Geo indexes.  
2. Profile Services (use to be UPS) gets core fields from central AAD and local fields are stored at a tenancy level (good news).  
3. Taxonomy (MMS) is replicated downwards from the central MMS.
4. Each tenant has it's own content type hub (I never liked this), the CTH uses a star topology to push the CTHub from the central tenant to the regional tenants so the copies including GUIDs are identical.

SPO to the Geo-Rescue (coming soon, in pre-beta/private preview as of 6 June 2018):

• SPO is implementing multiple tenants across O365 like O365 previously did for OneDrive, you can specify where sites get created i.e. region/country.  Each region as it's data centres specified and the URL of the Sites clearly indicates where the site is hosted.
• The search index is kept in-country and federated up to the central tenant for a seamless search experience across multiple region tenants.
• Central taxonomy is automatically replicated to the regional tenant.  MMS us a star topology to distribute and keeps GUIDs in sync.
• UPA holds only key data centrally and each region holds additional properties (good for GDPR and other DPA regulations).
• AAD shall be controlled centrally and I believe AAD's have regional copies.  * Each O365 has it's own AAD today, this will be the big change to facilitate SSO.

RoadMap:
OneDrive is multi-geo now. Offered to large enterprises only, must have certain number of users.
Circa Q1 2019 SharePoint will offer multi-geo.

http://blog.sharepointsite.co.uk/2013/08/stretched-farms-geo-replication-and.html

Stretched farms, Geo-replication and options

Stretched farm: A stretch farm is where you put a single farm into 2 data centres.  This provides redunancy across locations improving HA and DR.   Generally the 2 data centres will be located relatively close to one another geographically as the ping time needs to be less than 1 ms from any WFE to the primaray SQL Server database and at least 1 gigabit per second bandwidth.  hospitals with multiple sites / data centres that have good network connectivity and are located close together is a perfect example.

Geo-replication: SharePoint 2013 like previous versions does not have Geo-replication built into the product.  You can use PowerShell to provide this functionality.  A more achievable approach is to use a 3rd party tool such as DocAve to achieve and maintain Geo-replication.

SharePoint 2013 Geo-Replication

Another option, without the hassel to GEO-Replication is to use Riverbed devices distributed around your corprate network.  This decreates network requirments and improves the end user experience and does not involve syncronising data to multiple farms.  Riverbed's website.