This article contains general explanations about where UCMA should be installed and how "Trusted Application" works.
UCMA
UCMA is a software component by Microsoft that we install on certain servers (typically the Access Portal Server).
This component allows for3rd party developers to access and control the following aspects of Skype for Bussiness internal functionalities:
- Microsoft's Enhanced Presence information.
- Impersonating messages.
- Telephone and video calls.
- Audio/video conferencing.
This component integration combined with setting the Trusted Application configurations allow us to perform manipulations and use the SfB/Lync environment in order to do the following:
- Ethical Wall policies based on Contact list - Use Contact list information pulled from the SfB environment to set certain Ethical wall policies that apply according to contact list members.
- User/Admin notification - Send IMs to users and admins from the local SfB environment in order to notify them about Ethical wall/DLP/etc. actions that were performed.
- Organized conference for MDM registration - Create a conference after device registration when using 3rd generation MDM to ease the registration process.
Trusted Application
As part of the installation of the UCMA certain configuration in the SfB/Lync topology. These configurations allow the environment to identify and authenticate the 3rd party application that are trying to access them (Access Portal Web App/SIP Filter).
Skype for Business presents 4 entity types within the model of Trusted Applications.
Trusted Application pool
A trusted application is a Skype for Bussiness entity that is configured under a Server pool and represents a collection of internal functionalities/components of the Server Pool(named Trusted Application).
You can list the existing Application pools by running the following command in Powershell on the Front-End
Get-CsTrustedApplicationPool
Trusted Application
A Trusted Application is an entity within the pool that specifies an identity and connectivity details for different components utilizing the Application Pool
Sphereshield set 3 Applications
| Trusted Application name | Port | Usage | Pool | Required |
|---|---|---|---|---|
| SkypeShieldTrustedApp | 1111 | Access Portal | Access Portal pool | Yes |
| MaintenanceServiceTrustedApp | 1113 | Maintenance Service | Access Portal pool | Yes |
| SipFilterTrustedApp | 1112 | SIP filter on the Front-End | Front-End pool | No |
You can list the existing Application pools by running the following command in Powershell on the Front-End
Get-CsTrustedApplication
Trusted Application Endpoint
A trusted application endpoint is an Active Directory contact object that enables the routing of calls to a trusted application.
Sphreshield requires it for IM notification and enable the ability to impersonate a SIP address
You can list the existing Application pools by running the following command in Powershell on the Front-End
Get-CsTrustedApplicationEndpoint
Trusted Application computer
Not used by Sphereshield