The Ultimate Guide to Mastering Microsoft 365
Entra ID retains audit log records for service principal signins for 30 days. The audit data can reveal some interesting insights such as the presence of unexpected service principals or access to an application from an external source, or even the use of an app secret by an application instead of a more secure method. It’s time to write some PowerShell to interpret the data.
A set of new granular Graph permissions for User account management is now available to handle common operations like changing account passwords or updating phone numbers. There’s no need to update existing code unless you want to use the principle of lease privilege, in which case you’ll replace the current permissions with the new permissions. My feeling is that relatively few will go update code, but I could be surprised.
Monthly update #116 (February 2025) is available for the Office 365 for IT Pros eBook. The refresh includes update #8 new files for the Automating Microsoft 365 with PowerShell eBook. We’ve also updated the print (paperback) version that’s sold on an on-demand basis through Amazon.com. Things keep on changing inside Microsoft 365 with agent management a new challenge that’s coming into view.
Microsoft reannounced the Teams policy to suppress certain categories of in-product advertising messages but has done nothing to control Teams pop-up messages that irritate users. The volume of pop-up messages appears to have increased, or maybe it’s my frustration level that’s rising. A simple setting to turn informational pop-up messages would be appreciated.
Microsoft’s FY25 Q2 results featured bumper Microsoft Cloud revenues, which broke the $40 billion mark for the first time. Although they wanted to talk a lot about Copilot and AI in general, Microsoft didn’t give any new user numbers for Microsoft 365 or Teams.
This article covers how to use HVE with Azure Automation to send email. HVE is Exchange Online’s High Volume Email solution for internal communications. In the discussion, we cover how to retrieve credentials from Azure Key Vault, how to retrieve data from a web page, and how to bring everything together in a message submitted to HVE.
This article describes how to use Azure Automation for audit searches. The runbook runs an audit search to find events for specific operations, refines the set of events found by the search, and sends the information by email. Hopefully, someone will respond to the message and do the right thing to check the insight derived from the events.
Monthly update #8 is now available for the Automating Microsoft 365 with PowerShell ebook. Subscribers can download the updated files from Gumroad.com. The Office 365 for IT Pros eBook includes Automating Microsoft 365 with PowerShell. Both books are updated monthly. Mastering the Microsoft Graph is a major focus of the PowerShell book, which should be helpful to anyone trying to upgrade scripts from the old AzureAD and MSOL modules.
Entra ID allows unprivileged users to update the user principal name for their accounts via the admin center or PowerShell. It seems silly because no justification for allowing people to update such a fundamental property is evident. Perhaps Microsoft has some excellent logic for allowing such updates to occur, but blocking access seems like the right thing to do.
After creating a runbook to process Microsoft 365 data, registering the runbook with an automation schedule means that the runbook will execute on a reliable basis. This article discusses how to publish and register a runbook so that an automation schedule takes over the burden of running the job. In addition to describing the necessary steps in the Azure portal, we also give you the PowerShell commands.
The second part of the Azure Automation runbook primer brings us to output, specifically how to create items generated by a runbook in a SharePoint Online list. Once in the lists, items can be processed using Power Automate, Power Apps, or Power BI or exported to Excel. It’s a great way of capturing information generated by background jobs.
A reader asked why it seems so difficult to use Azure Automation runbooks to process Microsoft 365 data. In fact, it’s not so hard, and here’s a primer to help you understand how to create the necessary Azure Automation environment to develop and execute runbooks. Once modules and permissions are in place, everything falls into place.
Deleting an Entra ID user account can result in ownerless groups if the account being removed is the only group owner. Before deleting accounts, it’s a good idea to proactively replace group owners. This article explains how to replace group owners in the fastest and most scalable manner using the Microsoft Graph PowerShell SDK.
The Microsoft 365 user profile card offers users the chance to record and playback name pronunciations, if tenant settings allow. The new setting is controlled by a Graph API and turns name pronunciation recording and playback on or off for the entire tenant. Microsoft says that helping people pronounce other peoples’ names properly is a good thing. It will be interesting to see how many use this feature.
The Microsoft 365 Copilot Chat app is the free to use chat app available to commercial Microsoft 365 customers. The free chat app now supports Copilot agents, including agents that are grounded against Graph data (on a pay-as-you-go metered basis). The free chat app is highly functional, and Microsoft hopes that it will convince customers to buy the full-fledged Copilot.
After many twists and turns since August 2021, the MSOnline module retirement will happen in April 2025. The AzureAD module will then retire in the 3rd quarter. It’s way past time to upgrade PowerShell scripts. The question is whether to use the Entra module or the Microsoft Graph PowerShell SDK. I know which option is best and say why in this article.
Microsoft released the SharePoint Pages API in mid-2024. This article describes how to create and publish a news item using cmdlets from the Microsoft Graph PowerShell SDK based on the API. The net result is that the API appears to work well but some problems are evident in the cmdlets. Or maybe it’s just my lack of knowledge!
In January 2025, Teams will support the ability to post video clips to channel conversations in posts and replies. The feature is similar to that released for Teams chat in September 2022. It’s also similar to the ability to include a video clip in Outlook messages. Given the popularity of video clips in other apps, it’s likely that this feature will be popular with users.
The Office365ITPros GitHub repository holds over 370 PowerShell scripts showing how to interact with Microsoft 365 and Entra ID. Anyone can contribute to Office365ITPros by forking the code to a copy of the repository and making changes to scripts there. If you want, you can push the changes back to us so that we can consider their inclusion in Office365ITPros. It’s a great example of community in action.
Microsoft is deploying the option for meeting organizers with Teams Premium licenses to use OTP verification to allow anonymous users to verify their identity. The new option fills in a gap where external people who don’t have an Entra ID or MSA account are unable to verify their identity to join a Teams meeting. It’s a good feature, but should it be available in the basic Teams license?
Microsoft plans some big changes for Teams recording and transcription policies in February 2025. Events like webinars and town halls get separate controls for recording and transcription through the Teams event policy. By default, meeting transcription is enabled to generate transcripts for more meetings (and make transcripts available to Copilot). In addition, face and voice profile enrollment is enabled by default (important if you have Teams Rooms devices).
An interesting article by Microsoft’s Mark Kashman lists his top five SharePoint features shipped in 2024. Four of the five features involve extra cost. Is the trend of Microsoft charging extra for most new features likely to continue in 2025? The need to generate additional revenues from the Microsoft 365 installed base probably means that this is the new normal.
SharePoint Online intelligent versioning uses algorithms to decide what file versions must be kept for file recoverability. Unwanted versions are discarded (trimmed). A notional 500 version limit applies when intelligent versioning is in force but if data lifecycle management (retention) is used, SharePoint cannot trim versions to keep within the 500 version threshold. Some change is needed to resolve the conflict.
I’ve used Teams avatars for a couple of years but never liked them all that much. The chance to create a Teams avatar from a photo seemed like a great idea. Alas, the results obtained from uploading a professional headshot photo or from an image captured by the PC’s camera didn’t live up to expectations. The avatar is closer to my reality, but not by much.
News that Viva Engage search results are included in the results generated by Office.com and SharePoint.com is not unexpected. Only certain Viva Engage items appear in search results such as storyline items and question and answers from public communities. In other news, ten years after Microsoft’s Acompli acquisition, there’s no doubt that Outlook Mobile is a huge success.
Monthly update #115 is now available for download by subscribers to the Office 365 for IT Pros (2025 edition) eBook. The files available to subscribers also include an update for the Automating Microsoft 365 with PowerShell eBook. Those who bought the PowerShell book without buying the Office 365 for IT Pros bundle can also download the update.
On 19 December 2024, Microsoft announced the retirement of the Microsoft Search in Bing feature. Copilot is better at searching and presenting web and work results. Although tenant administrators might worry about the recent batch of retirements, the fact is that Microsoft retires unsuccessful products and features from Microsoft 365 all the time. The swift demise of the Office tags feature is another example.
Microsoft loves branding exercises. At least, that can be the only reason why the Microsoft 365 Copilot rename is happening. I can think of no other reason why Microsoft would seek to confuse its customers by applying the Microsoft 365 moniker to an app that can’t access Microsoft 365 data, unless of course people pay to use Copilot agents. It’s all very confusing.
The Copilot inference and evaluation policy controls if users can ask Copilot in Teams to evaluate the emotions of other meeting participants. It sounds creepy that meeting participants can ask Copilot how someone is feeling based on their contributions to a meeting, but AI is happy to answer unless blocked by policy. Maybe blocking big brother monitoring should be the norm rather than an exception?
Two types of retention labels are in use: Microsoft 365 retention labels and MRM retention tags. Clients hide the difference, but the Microsoft Graph PowerShell SDK cmdlets can only process Microsoft 365 retention labels for files stored in SharePoint Online and OneDrive for Business. EWS can manage MRM retention tags, but it’s on a fast path to retirement in 2026…
On December 12, Microsoft said that they want to make the Search-UnifiedAuditLog cmdlet use high completeness for all its searches. If implemented, the result will be a disaster because many of the current uses of the cmdlet to retrieve audit log data will be rendered impracticable because of the slowness and unreliability of high completeness searches. Microsoft just doesn’t seem to understand how its software is used in production.
In January 2025, Microsoft will introduce resizable Teams windows for the Windows and Mac desktop clients. This is a fundamental change to the client experience that will affect how end users interact with Teams. In a nutshell, users can resize panes like the chat list or meeting stage to a minimum of 360 pixels, which isn’t a lot. On the other hand, you can zoom a Teams window to 400%, which is definitely a lot.
Microsoft originally were going to license the Outlook Org Explorer to E3 and E5 users. Then they had the clever plan to license the feature through Viva. The gloss has gone off that idea and now Microsoft says that all commercial Microsoft 365 users will be able to use the Org Explorer starting in early 2025. In other news, you’ve been given 15 months’ notice about Outlook toggling.
The SharePoint Online Block Download Policy controls the ability to use features that rely on downloaded files (including temporary files), such as printing or editing with the Office desktop apps. It’s the kind of configuration that organizations might use for sites that hold very confidential files. Although the Set-SPOSite cmdlet can configure the policy for a site, it’s easier to use a container management label.
A February 2025 deadline looms for Outlook classic add-ins that use legacy Exchange tokens for authentication. Add-ins must switch to nested app authentication (NAA) to have continued access to Exchange mailboxes and other objects. The upgrade is easy enough if the ISV that developed the original add-in is still in business. Things get a lot more complicated when they’re not, or you have no idea who developed an add-in.
The scheduled retirement of Delve on December 16, 2024, meant that Microsoft had to create a new way for users to update their profile settings. The new method has now appeared in Microsoft Search, and it will spread to other workloads (like OWA) where users can access and update their profile. The new mechanism is welcome, but it’s still too difficult to customize user profiles within a tenant.
Microsoft’s announcement of the Viva Goals retirement came as a complete surprise to the customers using Viva Goals to implement the OKR methodology for their organization. From Microsoft’s text, it seems pretty clear that Viva Goals just didn’t succeed in winning sufficient customers to warrant ongoing development. The outcome is that Microsoft cut its losses and will retire Viva Goals.
A recent report noted an increase in social engineering attacks through Teams federated chat. You can stop these attacks by limiting external access to an allow list of known domains, which is what I do. Or you can depend on the technology built into Teams to detect suspicious connections and remind users about potential risk. This now extends to connections from brands commonly targeted by phishers.
A November 26 announcement says that Microsoft 365 Video will bring Stream and Clipchamp together under the Clipchamp brand. A lot of hard work over the past few years created the potential for unification as Stream moved to the SharePoint platform and Clipchamp embraced the Microsoft 365 framework. Bringing the two solutions together into a unified Microsoft 365 video platform makes perfect sense.
Intelligent versioning means that SharePoint Online manages file versions automatically and only keeps what’s needed. The feature works for OneDrive too, if only you can figure out how to enable it. Intelligent versioning can be enabled for a OneDrive account manually. PowerShell is the best option to enable intelligent versioning across a tenant. But how? We explain all here.