The Connect service and Lync Presence Provider (LPP) are Skype for Business trusted-UCMA applications. You must be a member of the RTCUniversalServerAdmins and Domain Admins security groups to provision and publish new applications in the Skype for Business Topology. If you have a designated Skype for Business administrator within your organization, that person should perform all subsequent preparation steps for this procedure.

To provision the computer hosting the Connect and Presence services as a trust application server with Skype for Business, you must use the Skype for Business Management Shell to complete the following tasks:

1. Create a trusted application pool as a virtual container for one or more computers hosting the BEMS-Connect service and the BEMS-Presence service.
2. Designate trusted applications for the use of the BEMS computer.
3. Create a trusted-computer entry for every BEMS in the environment.
4. Create one or more virtual trusted application endpoints for the Presence service.
5. Publish the changes to the Skype for Business topology.

A trusted application pool is a virtual pool or container of one or more trusted application servers, (for example, the Connect service and the Presence service). The trusted application cmdlets define parameters for the services available in the trusted application servers that are associated with the trusted application pool, (for example, the application identifier for Connect service and the Presence service and the listening ports used by these services). The trusted application pool doesn't provide load balancing services for the Connect and Presence services. It only provides configuration and registration information to the Skype for Business to allow the messaging servers to route incoming chat requests or presence status updates to the mobile users being managed by each Connect and Presence service. A BlackBerry Connect app user cannot be represented by more than one BEMS-Connect service at any time. Any type of load balancing or user endpoint distribution is managed by the Connect service directly.

A trusted application endpoint represents a virtual user to allow the Presence service to subscribe to SIP-enabled users to receive presence availability updates and make this information available to mobile users (for example, BlackBerry Work users). One or more trusted application endpoints must be created for each Presence service on the Skype for Business to process subscriptions. "Trusted application endpoint" only refers to the virtual user used by the Presence service to make the subscription requests. The endpoint remains on the computer hosting the BEMS-Presence service. The Presence service only communicates with the Front End Pool using port 5061. When a subscription is made to a SIP-enabled user to receive availability updates, the Skype for Business Front End Pool sends the user's updated presence status on port 49777 to the Presence service. The number of subscriptions handled by each Presence service and each trusted application endpoint used by the Presence service is managed by the Presence service. For more information about creating trusted application endpoints, see "Manually configure the Presence service for multiple application endpoints" in the Presence Configuration content.

After updating the topology, the administrator must delegate RTCUniversalReadOnlyAdmins permission to the BEMS service account for the BEMS Dashboard to access the provisioning information during the BEMS configuration process.