The Microsoft 365 admin center includes the ability to manage settings for the default Exchange Online authentication policy. You might have other policies to allow selective access with basic authentication to some protocols; these policies must be managed with PowerShell. Authentication policies are part of the journey to eliminate basic authentication from Exchange Online, now expected to happen in mid-2021.
OneDrive for Business accounts belonging to ex-employees can be reassigned to others during the deletion workflow, but orphan accounts can accumulate over time. This post describes a PowerShell script to find orphan OneDrive accounts and add a user to the site so that anything there can be retrieved.
Microsoft posted a reminder that connections from Office 2013 will no longer be supported for Office 365 service from October 13, 2020. Microsoft won’t take any action to block legacy clients, but the writing is on the wall. Office 365 tenants need to decide how to replace Office 2013 by either upgrading to Microsoft 365 apps for enterprise (click to run) or switching to browser clients like OWA.
Teams supports the ability to assign policies to up to 5,000 users with background jobs. This makes it much easier to assign new policies to large groups of users. Unless you like writing your own PowerShell scripts to handle Teams policy assignment, this is definitely something that all Teams administrators need to know about.
You can disable Chat for Teams users, but is this a good idea? Chat is an integral part of Teams and disabling it seems like a bad idea for many reasons, not least being compliance as all you’ll do is drive users to find another way to communicate – like WhatsApp.
Sensitivity labels are spreading across Office 365. Now you can search SharePoint Online to find documents with a specific label. And if you make an extra tweak to the search schema, you can find labeled sites too. All of which seems boring and uninteresting until you actually need to do it.
Microsoft Stream administration include a Manage deleted users option. However, you can’t manage a deleted user until all trace of their account has been removed from Azure AD, which means that you usually must wait 30 days for an account to be hard-deleted. It’s logical, but not in a good way.
Many PowerShell modules are available for Office 365 applications. Keeping them up to date can be a pain, so here’s a PowerShell script to automate the task. Using the latest modules means that you can access new and updated cmdlets, which might make all the difference to your scripts.
The Groups section of the Microsoft 365 admin center has been overhauled recently and several useful changes were made. Restore deleted groups is the headline act, but the other updates also deliver value. Collectively, they make Groups easier to manage.
Microsoft Stream doesn’t support Office 365 retention policies, so you can’t make sure that videos are kept for eDiscovery or compliance purposes. But a little lateral thinking and some PowerShell code quickly gives us a solution based on events from the Office 365 audit log, including emailing the report to someone designated to review videos before final deletion.
Because it sits on top of so many Microsoft 365 components, Teams is easily the hardest Office 365 workload to backup. You can try to backup Teams by copying its compliance records stored in Exchange Online, but that’s only a partial (and bad) solution that utterly fails to take the full spectrum of Teams data into account.
Many migration projects use Exchange Web Services (EWS) to move data to Exchange Online. EWS is using throttled to preserve resources. Here’s how to lift the restrictions for up to 90 days, all without going near a support call.
Changes coming in May and June will allow organizations to make online meetings the norm when created by OWA or Outlook mobile clients. You can control the feature at the organization level and allow individual mailboxes to override the organization setting.
I’ve written many articles to explain how to use the Office 365 audit log to report different aspects of the platform. But taking action is much better than just reporting. In this post, we explain how to take a report generated from the Office 365 audit log and use it to drive some actions. In this case, removing the SendAs permission from people who aren’t using it.
Microsoft’s service description for OneDrive for Business promises “beyond 1 TB, to unlimited” storage. In reality, most enterprise Office 365 accounts have 5 TB storage and won’t need to go further. But you can… first to 25 TB and then even more in the form of SharePoint sites. You just have to talk nicely to Microsoft support.
An item in the Teams release notes tells us that analytics are now available for channels. You can find out how many topics and replies are posted within a channel. You’ll probably know what channels are in heavy use anyway, but seeing how little traffic some channels get is a good way of knowing that maybe your teams don’t need those channels.
Do you need to find out who updated a SharePoint Online or OneDrive for Business document? Use PowerShell to search the Office 365 audit log for document events and the complete history is available. Well, at least the last 90 days’ history – or 365 days if you have the necessary licenses.
Several updates are available for the standard usage reports in the Microsoft 365 Admin Center. One helps Office 365 tenants understand the changed user activity profile due to remote working. Another gives views of user activity across the complete tenant. The updates are useful and interesting, but an ISV product will do a better job of analyzing and reporting the same data.
The Teams Admin Center now includes a Manage Apps page to allow administrators to view the complete inventory of apps available to Teams. Administrators can decide if they want to make apps available to users via Teams app setup policies or block the installation of apps. Each app has a publisher and certification status, but not many apps have been through the full “Microsoft 365 certified” process, including many of Microsoft’s own apps.
Microsoft is updating the Teams default meeting policy to enforce lobby entry for external users. Sounds good, but what does this mean? This post explains what happens and how Microsoft is able to update the default meeting policy for many tenants while not affecting the tenants who have customized their default meeting policy.
If an Office 365 tenant goes to the bother of creating nice OWA autosignatures for users, shouldn’t we also removed the ability to edit the signatures in OWA settings? RBAC seems like the right way to do the job, but in this case, the way RBAC restricts options by removing the right to run cmdlets or parameters means that the block affects other OWA settings. Fortunately, the Exchange developers thought of this and provide an option in OWA mailbox policies to save the day.
PowerShell is a great way to get work done with Office 365 data. The downside is that PowerShell can sometimes be slow, which is why we look for ways to speed things up, especially when dealing with some of the “heavier” cmdlets like Get-UnifiedGroup. The good news is that switching loops to use the ForEach method can speed things up. The bad is that you might only squeeze an extra 5% performance out of your code. Is that enough to bother? Your call…
Exchange Online mailboxes support SendAs, Send on Behalf Of, and FullAccess permissions. A previous script focused on the FullAccess permission. This version covers all three. It’s also a good example of how you need to pay attention to property sets when writing PowerShell code to use the new Exchange Online REST-based cmdlets.
SharePoint Online comes with a reasonable amount of free storage, but it’s surprising how quickly that storage can be consumed, especially if you use Office 365 retention policies. With that thought in mind, it’s a good idea to check what sites are consuming your SharePoint storage. This post covers how to write a PowerShell script to report SharePoint Online site storage, complete with a couple of bells and whistles.
Office 365 licenses can seem complex, especially when you descend to the level of multi-product license plans. PowerShell makes it easy to generate a quick and simple report of who’s been assigned which license. And best of all, because the code is PowerShell, you can amend it to your heart’s content.
Exchange Online makes it easy to assign delegated permissions for user and shared mailboxes. But permissions assigned to people might not be still necessary, so it’s good to do a periodic check. In this post, we describe a script to scan for permissions on Exchange Online user and shared mailboxes and highlight non-standard permissions in a report generated as a CSV file.
Exchange Online enables mailbox auditing by default, which should mean that audit events get to the Office 365 audit log for all E3 and E5 mailboxes. Well, that’s what you might thing but that’s not what happens. Mailbox events for E5 mailboxes arrive just fine, but you must reenable E3 mailboxes for auditing before their events flow. It’s a bizarre situation.
Azure Active DIrectory is getting a slimmed-down background image to help with bandwidth-constrained locations. Office 365 tenants with custom backgrounds won’t see the change. Customizing the appearance of the sign-in screen is easy if you prepare. And to finish up, we have pointers to a set of videos about how Azure Active Directory authentication works.
Some doubt that Exchange Online will disable basic authentication for five email connection protocols in October 2020. The refrain is that it will be too hard for customers. Well, it might be hard to prepare to eliminate basic authentication, but if you don’t, your Office 365 tenant will be increasingly threatened by attacks that exploit known weaknesses.
The Office 365 compliance framework can now to place holds on Teams compliance records created for conversations in private channels. You simply have to place holds on the mailboxes of members of the private channels and hope that no one removes the members from the tenant. If they do, the hold lapses, which seems like a pity.
Teams App Security policies now include an Allow user pinning setting, which controls the ability ot users to pin apps to the left-hand navigation rail. The setting is enabled by default and probably can stay that way in most circumstances. Guest users don’t get to pin anything because their accounts are not policy-controlled.
The Microsoft 365 Compliance and Security centers are roling out to Office 365 tenants where they’ll replace the old Security and Compliance Center over time. The new centers look fresher than the SCC, but looks can deceive and it’s much more important that the functionality exposed in the new portals work reliably all the time.
Office 365 Groups (and their underlying teams and sites) can be removed by user action or automatically through the Groups expiration policy. By examining records in the Office 365 audit log, we can track exactly when groups are soft-deleted followed by permanent removal 30 days later. All done with a few lines of PowerShell and some parsing of the audit data held in the records.
A question asked how to be notified when people delete Teams. The answer lies in the Office 365 audit log, and once we’ve found out when Teams are deleted are who deleted them, we can notifications to administrators via email or by posting to a Teams channel. The administrators can then decide if they should restore the deleted team or let it expire and be permanently deleted after 30 days.
Chrome 80 appears on February 4 complete with “SameSite” updates to close off the potential for cross-site request forgery attacks. Office 365 has many web interfaces, so Microsoft has had to do some work to prepare for Chrome 80. Microsoft says that Office 365 is prepared but customers will have to apply patches for on-premises products, once the patches are available. Or stop using Chrome. Which mightn’t be a bad thing.
Office 365 users might receive a phishing attempt to say that they’ve just been paid by a UK healthcare group. The message shows some obvious signs to tell the recipient that it only contains trouble, but these signs are easier for humans to pick up than they are for machine learning. The combination of good message hygiene and user education should be enough to deflect phishing attacks.
The Groups admin role was added to Office 365 in November 2019 to allow tenants to assign responsibility for day-to-day group management to specific users through interfaces like the Microsoft 365 Admin Center. The role is still relatively unknown and probably not used in many tenants. In this post, we discuss how to use PowerShell to assign the role to those allowed to create new groups.
In mid-February, Microsoft will roll out a change to allow Office 365 tenants in regions where the Teams and Stream services are not co-located to record Teams meetings for the first time. This might be good news for you, but it might also pose a data sovereignty issue because once you start using Stream in another region, that’s where the recordings will stay.
After a couple of years, it’s time to update the Office 365 Groups and Teams Activity Report script. Written in PowerShell, the script analyzes the groups in an Office 365 tenant to figure out if each group or team is in active use. Because it’s a PowerShell script, you can amend the code to your heart’s content.
In November, Microsoft set a 1TB limit for Exchange Online auto-expanding archive mailboxes. Now they’ve retreated and the latest service description says nothing about a limit. The two changes in the service featured little or no customer communications and a total lack of any supporting material, like administrative controls to help manage archive mailboxes approaching the limit. While a limit has gone for now, it will be back.
