Distributed Collaboration with ArcGIS Online and an Internal ArcGIS Enterprise?

[DavidCrosby]

Since the release of ArcGIS Enterprise 10.5.1, distributed collaboration has been a powerful way to connect and integrate your web GIS across a network of participants.  Distributed collaboration has made it possible to organize and share content between entities and organizations including departments, other governments, private businesses and more.

During the time since the release of distributed collaboration, the implementation of ArcGIS Enterprise “on premises” at customer sites has also grown.  And for good reason!  Deploying ArcGIS Enterprise at your site gives you complete control over your deployment while providing the core capabilities of organization-wide mapping, analysis, data management, sharing and collaboration.

While working with ArcGIS Enterprise customers I have discovered a common misconception regarding the ability of an internal-only ArcGIS Enterprise to collaborate with ArcGIS Online.  A common deployment pattern for ArcGIS Enterprise is to not deploy the system as public-facing at your site.  The system is deployed for internal customers only.  The general public cannot connect to this system over the public Internet and items, services, and data are all behind the organization’s firewall.  The misconception is that this internal-only ArcGIS Enterprise cannot sync (send and receive) items such as web maps, apps, and feature layers with ArcGIS Online.  It can!

In such a scenario, even though ArcGIS Online is considered the host of the collaboration, all communication is initiated by ArcGIS Enterprise from behind your firewall.  To enable this, organization firewall rules must be configured to support outbound communication on port 443.  A few other technical details include:

The following URLs must be whitelisted/reachable by the ArcGIS Enterprise machine:

• https://ago-item-storage.s3.amazonaws.com
• https://*.arcgis.com
• https://*.arcgisonline.com
• http://*.esri.com
• https://*.blob.core.windows.net

The Portal for ArcGIS service account that runs the Portal for ArcGIS service needs access to the Internet.

Once the above requirements are met you may proceed to set up your collaboration.

It might seem counterintuitive that your internal ArcGIS Enterprise can sync with ArcGIS Online and even receive items.  It is not only possible, but can be a very effective way to extend the reach and use of your web GIS. 

[AJ_devaccount]

@DavidCrosby  is it possible to set up a collaboration between ArcGIS Enterprise that's behind a firewall and AGOL, so that data from the Enterprise (referenced) can be added to an Open Data Hub? The public should be able to download the referenced data. 

[DavidCrosby]

Hi @AJ_devaccount if I understand the scenario correctly, this would not work.  The referenced data would still reside on ArcGIS Enterprise behind the firewall.  To access it, the client would need to make a request through the firewall to get the data.  In the case of a Distributed Collaboration where a copy is shared, the request will originate with ArcGIS Enterprise behind the firewall and the data sent to ArcGIS Online.  You could add the reference to the data to ArcGIS Hub, but the client would not be able to access it.  In your case, you would want to share as a copy, and use that copy with ArcGIS Hub (Open Data)

[AJ_devaccount]

@DavidCrosby thanks very much for your response! We'll have to share copies to AGOL then. Would an Enterprise service have to be shared publicly for the AGOL copy to also be publicly available for downloading?  

[DavidCrosby]

@AJ_devaccount No, once you share to ArcGIS Online as a copy through the Collaboration, the two items are independent and you can set the sharing properties of the ArcGIS Online item independently of the sharing in ArcGIS Enterprise.