1 562.921.0202
[email protected] ibedigital.com 11266 Monarch St. B, Garden Grove, CA
City of Norwalk
ADFS Decommission, FOIA SSO Migration
to Entra & Exchange Decommission
To: Mike Johnson
City of Norwalk
From: Ma1 Abshire
IBE Digital
[email protected]
(562) 921-0202
Date: September 17, 2026
Attachment No. 2
2 562.921.0202
[email protected] ibedigital.com 11266 Monarch St. B, Garden Grove, CA
Table of Contents
1. Overview ............................................................................................................................ 3
2. Scope of Work..................................................................................................................... 3
3. Assump7ons and Dependencies.......................................................................................... 5
4. Out of Scope ....................................................................................................................... 5
5. Commercial Terms............................................................................................................... 6
6. Investment.......................................................................................................................... 7
7. Terms and Condi7ons.......................................................................................................... 7
8. Authoriza7on and Signatures............................................................................................ 10 3 562.921.0202
[email protected] ibedigital.com 11266 Monarch St. B, Garden Grove, CA
1. Overview
This Statement of Work (SOW) establishes the scope, deliverables, and commercial terms for IBE Digital's engagement with the City of Norwalk (hereinaEer the Client) to consolidate the City's idenFty and messaging footprint onto MicrosoE cloud services. The engagement covers migraFng single sign-on (SSO) for the FOIA applicaFon from AcFve Directory FederaFon Services (ADFS) to MicrosoE Entra ID, decommissioning the on-premises ADFS environment, and decommissioning the City's on-premises Exchange server.
The work removes two legacy on-premises components, the ADFS federaFon service and the on-premises Exchange server, aEer their funcFons have been moved to MicrosoE Entra ID and Exchange Online respecFvely. This reduces the City's on-premises aNack surface, eliminates the maintenance and cerFficate-renewal burden associated with ADFS and Exchange, and consolidates authenFcaFon and mail on MicrosoE's managed cloud services.
All work will be performed in coordinaFon with City of Norwalk IT staff and sequenced into controlled maintenance windows to minimize risk to authenFcaFon and mail services.
The City of Norwalk currently operates an on-premises ADFS environment that provides federated authenFcaFon, including SSO for the FOIA applicaFon, and MicrosoE Entra Connect synchronizes idenFty from on-premises AcFve Directory to MicrosoE Entra ID. The City also operates an on-premises Exchange server that previously hosted the City's mailboxes in a hybrid configuraFon.
With the City's mailboxes migrated to Exchange Online and the FOIA applicaFon to be repointed to MicrosoE Entra ID for SSO, the on-premises ADFS and Exchange servers are candidates for decommission. MicrosoE Entra Connect will remain in place as the idenFty synchronizaFon mechanism between on-premises AcFve Directory and MicrosoE Entra ID.
2. Scope of Work
IBE Digital will perform the following work, sequenced to preserve authenFcaFon and mail availability throughout the engagement and scheduled with City IT staff.
Phase 1: FOIA Applica1on SSO Migra1on to Microso9 Entra ID • Review the current FOIA applicaFon SSO configuraFon in ADFS, including the relyingparty trust, claim rules, and the authenFcaFon protocol in use 4 562.921.0202
[email protected] ibedigital.com 11266 Monarch St. B, Garden Grove, CA
• Create and configure the corresponding enterprise applicaFon in MicrosoE Entra ID, reproducing the required sign-on seTngs, claims or aNribute mappings, and user or group assignments
• Coordinate with the FOIA applicaFon owner or vendor as needed to update the applicaFon's idenFty provider seTngs to trust MicrosoE Entra ID • Test SSO to the FOIA applicaFon through MicrosoE Entra ID with pilot users prior to cutover
• Cut over FOIA SSO to MicrosoE Entra ID and confirm successful authenFcaFon for users Phase 2: ADFS Decommission
• Confirm that no remaining relying-party trusts or applicaFons depend on ADFS prior to decommission
• Convert the affected MicrosoE 365 or Entra domains from federated authenFcaFon to MicrosoE Entra managed authenFcaFon, using the idenFty synchronized by MicrosoE Entra Connect
• Validate user authenFcaFon to MicrosoE 365 and Entra-integrated applicaFons following the conversion
• Decommission the ADFS server or servers and the associated Web ApplicaFon Proxy if present, including cleanup of related DNS records and cerFficates Phase 3: On-Premises Exchange Decommission
• Confirm all mailboxes, shared mailboxes, and public folders have been migrated to Exchange Online and that no mail flow depends on the on-premises Exchange server • Retain a supported Exchange management capability on-premises for the management of directory-synchronized mail aNributes, consistent with MicrosoE guidance for environments where MicrosoE Entra Connect remains in place • Perform a proper Exchange uninstallaFon of the on-premises Exchange server rather than a forced removal
• Clean up the associated AcFve Directory, DNS, connector, and cerFficate entries related to the decommissioned Exchange server
Phase 4: Valida1on and Handoff
• Confirm authenFcaFon to MicrosoE 365, the FOIA applicaFon, and other Entraintegrated services following all cutover and decommission acFviFes • Confirm mail flow and Exchange Online operaFon following the on-premises Exchange decommission
5 562.921.0202
[email protected] ibedigital.com 11266 Monarch St. B, Garden Grove, CA
• Update IBE Digital's documentaFon with the revised idenFty and mail configuraFon for ongoing managed-services reference
• Deliver a project compleFon sign-off confirming scope compleFon
3. Assumptions and Dependencies
This SOW is predicated on the following assumpFons. Material deviaFon from these assumpFons may require a Change Order to adjust scope and/or fees. • The City of Norwalk will provide IBE Digital with administraFve access to AcFve Directory, MicrosoE Entra ID, the ADFS environment, the on-premises Exchange server, and the FOIA applicaFon's idenFty provider configuraFon prior to project kickoff • The City's mailboxes, shared mailboxes, and public folders have been migrated to Exchange Online prior to the on-premises Exchange decommission; any mailboxes remaining on-premises will be addressed via Change Order • MicrosoE Entra Connect is in place and healthy, with password hash synchronizaFon or pass-through authenFcaFon available to provide cloud authenFcaFon once ADFS federaFon is removed
• The FOIA applicaFon supports MicrosoE Entra ID as an idenFty provider using a standard federaFon protocol (SAML or OpenID Connect); an applicaFon that cannot support Entra ID directly will be addressed via Change Order
• The FOIA applicaFon owner or vendor will be available to update the applicaFon's idenFty provider seTngs and to assist with tesFng during the engagement • The City will maintain current, validated backups of the ADFS and Exchange servers and of AcFve Directory prior to the decommission acFviFes
• IBE Digital will have the ability to schedule maintenance windows with City IT staff for the authenFcaFon cutover and the decommission acFviFes
• All work will be performed remotely unless on-site presence is mutually agreed upon; on-site travel Fme is not included in the esFmate
4. Out of Scope
The following items are explicitly excluded from this Statement of Work and may be engaged as separate projects or Change Orders as needed:
• MigraFon of the SSO configuraFon for applicaFons other than the FOIA applicaFon • MigraFon of mailboxes from the on-premises Exchange server to Exchange Online, which is assumed complete prior to this engagement
6 562.921.0202
[email protected] ibedigital.com 11266 Monarch St. B, Garden Grove, CA
• Removal or reconfiguraFon of MicrosoE Entra Connect, which remains in place as the idenFty synchronizaFon mechanism
• ApplicaFon-side development or reconfiguraFon of the FOIA applicaFon beyond updaFng its idenFty provider seTngs
• Changes to condiFonal access, mulFfactor authenFcaFon, or other Entra ID security policies beyond those required to complete the FOIA SSO migraFon • Decommission of any server other than the ADFS and on-premises Exchange servers named in this SOW
5. Commercial Terms
Engagement Type
This engagement is delivered on a fixed-fee basis for the scope of work defined in this SOW. The fixed fee covers all professional labor required to complete the scope of work.
Invoicing
• IBE Digital will invoice the fixed professional services fee per the schedule agreed with the City.
• Invoices are due Net 30 from date of invoice.
• Any approved Change Orders will be invoiced separately from the base SOW.
Change Order Process
Scope addiFons or material changes to the assumpFons will require a wriNen Change Order executed by both parFes prior to IBE Digital commiTng to the addiFonal work. 7 562.921.0202
[email protected] ibedigital.com 11266 Monarch St. B, Garden Grove, CA
6. Investment
The fixed professional services fee for the scope defined in this Statement of Work is set out below.
Professional Services $13,520.00
Fixed fee for the services described in Sec2on 2
Total Project Investment $13,520.00
Sourcewell Contract # 112124-KON
7. Terms and Conditions
By execuFng this Statement of Work, Client agrees to purchase the services designated above and further agrees that the services shall be subject to the following Terms and CondiFons of Service.
1. Fees and Payment: Client agrees to pay all fees specified in this SOW. Payment terms are net 30 days from date of invoice. Client shall be responsible for all applicable taxes arising from the services. IBE Digital may suspend service if Client has failed to pay any undisputed invoice within fiEeen (15) days of the due date. Undisputed invoices not paid by the due date may be subject to a monthly service charge which is the lesser of one and one-half percent (1.5%) per month or the highest rate allowed by law.
2. Limited Warranty: (a) IBE Digital warrants for a period of thirty (30) days following delivery (the "Warranty Period") that all services shall be performed in a professional manner in accordance with generally applicable industry standards. IBE Digital sole liability (and Client's exclusive remedy) for any breach of this warranty shall be for IBE Digital to re-perform any deficient services, or, if IBE Digital is unable to remedy such deficiency within thirty (30) days, to void the invoice for the deficient services. IBE Digital shall have no obligaFon with respect to a warranty claim: (i) if noFfied of such claim aEer the Warranty Period or (ii) if the claim is the result of third-party hardware or soEware failures, or the acFons of Client or a third party. (b) 8 562.921.0202
[email protected] ibedigital.com 11266 Monarch St. B, Garden Grove, CA
THIS SECTION 2 IS A LIMITED WARRANTY AND SETS FORTH THE ONLY WARRANTIES MADE BY IBE DIGITAL. IBE DIGITAL MAKES NO OTHER WARRANTIES, CONDITIONS OR UNDERTAKINGS,
EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, INCLUDING BUT NOT LIMITED TO
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT. ALL SOFTWARE AND HARDWARE PROVIDED OR INSTALLED BY IBE DIGITAL HEREUNDER ARE SUBJECT EXCLUSIVELY TO THE RESPECTIVE MANUFACTURER'S WARRANTY.
3. COMPENSATION FOR HIRING OTHER PARTY'S EMPLOYEES: During the term of this SOW and for a period of twelve (12) months following the terminaFon or expiraFon of this SOW, Client agrees not to directly or indirectly solicit for employment, hire, engage, or retain (whether as an employee, independent contractor, consultant, or otherwise) any employee or contractor of IBE Digital who was involved in providing services to Client under this SOW. In the event Client hires, engages, or otherwise retains the services of any such employee or contractor of IBE Digital, whether directly or indirectly (including through a third-party staffing firm or contractor), Client agrees to pay IBE Digital, as reasonable compensaFon for the loss of such personnel and associated recruitment and training costs, a fee of One Hundred Thousand Dollars ($100,000) for each such employee or contractor. This provision shall apply to any employee or contractor of IBE Digital who provided services to Client during the twelve (12) months preceding such hiring or engagement.
4. LIMITATION OF LIABILITY: (A) NEITHER PARTY SHALL BE LIABLE TO THE OTHER FOR ANY
INDIRECT, INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES (INCLUDING, WITHOUT
LIMITATION, DAMAGES FOR INTERRUPTION OF SERVICES, LOSS OF BUSINESS, LOSS OF PROFITS,
LOSS OF REVENUE, LOSS OF DATA, OR LOSS OR INCREASED EXPENSE OF USE), WHETHER IN AN
ACTION IN CONTRACT, WARRANTY, TORT (INCLUDING, WITHOUT LIMITATION, NEGLIGENCE), OR
STRICT LIABILITY, EVEN IF THE PARTIES HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH LIABILITIES. IBE DIGITAL SHALL NOT BE RESPONSIBLE FOR PROBLEMS THAT OCCUR AS A RESULT OF THE USE OF ANY THIRD-PARTY SOFTWARE OR HARDWARE. (B). EXCEPT FOR GROSS
NEGLIGENCE OR WILLFUL MISCONDUCT, IBE DIGITAL'S AND ITS SUBCONTRACTOR'S TOTAL
AGGREGATE LIABILITY TO CLIENT ARISING OUT OF SERVICES PERFORMED UNDER THIS SOW,
REGARDLESS OF THE LEGAL THEORY UPON WHICH SUCH LIABILITY MAY BE BASED, SHALL NOT
EXCEED THE TOTAL PAYMENTS MADE BY CLIENT TO IBE DIGITAL FOR THE SERVICES IN QUESTION IN THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE FIRST OCCURRENCE OF THE EVENT GIVING RISE TO SUCH LIABILITY.
5. ConfidenHal and Proprietary InformaHon: (a) Each party agrees that all know-how, business, technical and financial informaFon it obtains (as a "Receiving Party") from the disclosing party (as a "Disclosing Party") consFtute the confidenFal property of the Disclosing Party ("ConfidenFal InformaFon"), provided that it is idenFfied as confidenFal at the Fme of 9 562.921.0202
[email protected] ibedigital.com 11266 Monarch St. B, Garden Grove, CA
disclosure or should be reasonably known by the Receiving Party to be ConfidenFal InformaFon due to the nature of the informaFon disclosed and the circumstances surrounding the disclosure. Except as may be necessary to perform its obligaFons under this SOW, the Receiving Party will hold in confidence and not use or disclose any of the Disclosing Party's ConfidenFal InformaFon. The Receiving Party's nondisclosure obligaFon shall not apply to informaFon that:
(i) was known to it prior to receipt of the ConfidenFal InformaFon; (ii) is publicly available; (iii) is righoully obtained by the Receiving Party from a third party; (iv) is independently developed by employees of the Receiving Party; or (v) is required to be disclosed pursuant to a regulaFon, law or court order. (b) Any templates, schemaFcs, processes or technical documentaFon provided by IBE Digital shall be deemed ConfidenFal InformaFon and proprietary informaFon of IBE Digital without any marking or further designaFon. Client may use such informaFon solely for its own internal business purposes. IBE Digital shall retain all rights to the aforemenFoned, which shall be returned to IBE Digital upon terminaFon of the applicable SOW. (c) IBE Digital shall maintain the confidenFality of protected health informaFon in its possession or under its control in accordance with the Health Insurance Portability and Accountability Act of 1996, as amended by the Health InformaFon Technology for Economic and Clinical Health Act.
6. Independent Contractor: IBE Digital and Client shall at all Fmes be independent contractors.
There is no relaFonship of partnership, joint venture, employment, franchise or agency created hereby between the parFes. Neither party shall have the power to bind the other or incur obligaFons on the other party's behalf without the other party's prior wriNen consent.
7. Assignment: This SOW may not be assigned by either party without the prior wriNen consent of the other party, which consent shall not be unreasonably withheld or delayed. No consent shall be required where an assignment is made (i) pursuant to a merger or change of control or (ii) to an assignee of all or substanFally all of the party's assets. Any purported assignment in violaFon of this secFon shall be void.
8. Complete Understanding; ModificaHon: This SOW, as well as any applicable terms of service posted at www.ibedigital.com/terms, shall consFtute the full and complete understanding and agreement between Client and IBE Digital and supersedes all prior or contemporaneous negoFaFons, discussions or agreements, whether wriNen or oral, between the parFes regarding the subject maNer contained herein. Any waiver, modificaFon or amendment of any provision of this SOW shall be effecFve only if in wriFng and signed by both parFes.
9. Waiver and Severability: Waiver or failure by either party to exercise in any respect any right or obligaFon provided for in this SOW shall not be deemed a waiver of any further right or obligaFon hereunder. If any provision of this SOW is found by a court of competent jurisdicFon to be unenforceable for any reason, the remainder of this SOW shall conFnue in full force and effect.
10 562.921.0202
[email protected] ibedigital.com 11266 Monarch St. B, Garden Grove, CA
10. Force Majeure: Neither party shall be liable to the other for any delay or failure to perform any obligaFon under this SOW, except for a failure to pay fees, if the delay or failure is due to unforeseen events which are beyond the reasonable control of such party, such as strikes, blockade, war, terrorism, riots, natural disasters, power outages, and/or refusal of license by the government, insofar as such an event prevents or delays the affected party from fulfilling its obligaFons and such party is not able to prevent or remove the force majeure at reasonable cost.
11. Counterparts. This SOW may be executed in any number of counterparts and each fully executed counterpart shall be deemed an original. The parFes agree (a) that facsimile or electronic signature shall be accepted as original signatures; and (b) that the SOW, or any document created pursuant to the SOW, may be maintained in an electronic document storage and retrieval system, a copy of which shall be considered an original. In any legal proceeding relaFng to the SOW, the parFes waive their right to raise any defense based on the execuFon of the SOW in counterparts or the delivery of such executed counterparts by copy, facsimile, or electronic delivery.
8. Authorization and Signatures
By signing below, the authorized representaFves of both parFes agree to the terms, scope, and condiFons set forth in this Statement of Work.
IBE Digital
Authorized Signature
Printed Name & Title
Date
City of Norwalk
Authorized Signature
Printed Name & Title
Date
SALES QUOTE
Sales Quote No: 40737
Account No:
Date: 9/17/26
CO07
City of Norwalk - City Hall
12700 Norwalk Blvd
Norwalk, CA 90650
City of Norwalk - City Hall Ship To:
12700 Norwalk Blvd
Norwalk, CA 90650
Bill To:
Sales Person P.O. Number Ship Method Payment Terms Quote Expires On Notes
Sloan Varing UPS Ground No Freight Charge 30 Days 10/17/26 NCPA 01-170
Item No Description Quantity UM Price Disc Amount
GMGF0PN5D-0002-P Office LTSC Standard 2024 - Commercial 275.00 License $495.00 0.02 $133,402.50 NCE Office 365 G1
(GCC)
NCE Office 365 G1 (GCC) Annual Commit 275.00 License $120.00 0.02 $32,340.00 NCE Microsoft Entra
ID P1
NCE Microsoft Entra ID P1 (GCC) Annual Commit 275.00 License $79.20 0.02 $21,344.40 NCE Microsoft 365
F3 GCC
NCE Microsoft 365 F3 GCC (Governmental Community Cloud
Pricing) Annual Commit
65.00 License $105.60 0.02 $6,726.72
Discount
Sales Tax
Freight
Sales Order Total
Subtotal
$0.00
$193,813.62
$0.00
*Change in Remittance*
F&M Bank
Account Name: I Copy Inc dba IBE Digital
Account Number: 31074324
ABA/Routing Number: 122201198
$193,813.62
$0.00
SALES QUOTE
Sales Quote No: 40736
Account No:
Date: 9/16/26
CO07
City of Norwalk - City Hall
12700 Norwalk Blvd
Norwalk, CA 90650
City of Norwalk - City Hall Ship To:
12700 Norwalk Blvd
Norwalk, CA 90650
Bill To:
Sales Person P.O. Number Ship Method Payment Terms Quote Expires On Notes
Sloan Varing UPS Ground No Freight Charge 30 Days 10/16/26 NCPA 01-170
Item No Description Quantity UM Price Disc Amount
MST-R18-02412 WinSvrCAL LicSAPk OLV D 1Y AqY1 AP UsrCAL 575.00 License $12.00 0.02 $6,762.00 MST-9EA-00516 Microsoft Windows Server DC Core Software Assurance OLV 2 Licenses LevelD Additional Product CoreLic 1 Year
Acquiredyear1
64.00 License $213.00 0.02 $13,359.36
MST-359-04623 SQLCAL SA OLV D 1Y AP UsrCAL 100.00 License $58.00 0.02 $5,684.00 MST-228-07281 SQLSvrStd LicSAPk OLV D 1Y AqY1 AP 2.00 License $579.00 0.02 $1,134.84 Discount
Sales Tax
Freight
Sales Order Total
Subtotal
$0.00
$26,940.20
$0.00
*Change in Remittance*
F&M Bank
Account Name: I Copy Inc dba IBE Digital
Account Number: 31074324
ABA/Routing Number: 122201198
$26,940.20
$0.00