The Ultimate Guide to Mastering Microsoft 365
This article describes how to report the audit events for a user over a single day. The task seems simple, but inconsistency in audit payloads makes it harder. Workloads don’t help by the variations in audit events. In any case, persistence and knowledge about what the audit event captured for an action helps to decode the data, as illustrated by the script detailed here.
The Office 365 for IT Pros writing team is thrilled to announce the availability of the December 2024 update (monthly update #114). Current subscribers can download the updated EPUB and PDF files for the main book and the Automating Microsoft 365 with PowerShell book using their Gumroad.com account or the download files link in their receipt.
This article covers how to use Exchange Online message trace data to find inactive mailboxes based on their message send activity. The script processes user mailboxes but can easily be adapted to process shared mailboxes too. This is only one of the available methods to find inactive mailboxes. The other methods mentioned in the article might be better suited to your purpose.
Microsoft recently renamed the default set of sensitivity label permissions. Each permission defines the usage rights for a labelled item for users. The rights range from the basic actions like edit, save, and print to the more advanced extract, right to run macros, and export. The trick is to make sure that sensitivity labels assign the right permissions to users.
SharePoint generates document mismatch notifications when users create or update files with sensitivity labels that are higher than the site’s container label. Normally, everything works as planned, but if a tenant has a cloudy attachment auto-label retention policy, items can end up in site preservation hold libraries that generate document mismatches. The problem is that you can’t stop the mismatches!
Generative AI tools are nice to have, but the LLMs used by these tools must come from somewhere. The impact of generative AI on technology websites is very real and will have a far reaching effect if websites close due to reduced traffic and revenues. How will the LLMs used by generative AI refresh their knowledge base if websites don’t create that information for them (for free)?
The slew of product announcements at the Microsoft Ignite 2024 conference included lots about AI and Copilot. This article covers some of the more interesting announcements for Microsoft 365 tenants for Teams, SharePoint Online, and Purview. Many of the new features need high-end licenses or add-ons, but that doesn’t mean that the issues addressed by the technology should be ignored.
Service principal sign-in activity is a new insight available in the Entra admin center. As explained here, it’s also possible to use PowerShell to fetch and analyze the data to derive new insights into what apps create service principals in a tenant and what organizations own the apps. Some detective work is needed to fully understand the data. That might be an ongoing task, but at least we have the data.
The Purview Insider Risk Management solution can do all sorts of clever things, like tracking sensitivity label downgrades and removals as an indicator that a user might be preparing to exfiltrate data. The same kind of checking can be done by using the events captured in the audit log when people remove or change sensitivity labels. All in a few lines of PowerShell…
In a November 18 post, Microsoft describes some Exchange Online security updates that are due to land between now and 2026. Some of the news is a restatement of previously announced information, like the deprecation of EWS in October 2026. New information includes some information about feature caps that the Graph APIs cannot close when EWS goes away. And then there’s a hint about the demise of public folders (again!)
In February 2025, Microsoft will begin enforcing a mandatory MFA requirement for the Microsoft 365 admin center. All connections to the Microsoft 365 admin center must pass an MFA challenge. The move is to increase the percentage of Entra ID user accounts protected by MFA. This article explains what’s happening and outlines how to gain insight into who might be affected by the change.
The unified audit log is full of interesting information about who did what and when they did it. In this article, I describe how to use file operations audit events to find the last accessed date for documents in a SharePoint Online site. It’s data that isn’t available in the Microsoft Graph, but it is in the unified audit log.
This article describes how to create eligible and active PIM role assignment requests using cmdlets from the Microsoft Graph PowerShell SDK. Although the PowerShell code is straightforward, Microsoft recommends using the Entra admin center for Privileged Identity Management. But you can automate the management of role assignment requests if you want to.
Intelligent versioning recently appeared in SharePoint Online. The purpose is to save storage by removing unnecessary versions. But retention policies and labels can stop the removal of versions. This article explains what happens when SharePoint Online attempts to trim (remove) unwanted versions of files under the control of retention policies and labels.
In a November 8 post, Microsoft says that Purview Data Lifecycle Management will allow tenants to split processing of Copilot interactions and Teams chats with different policies. The public preview for the change should be available in mid-November. This update makes perfect sense because there’s no logic to dictate that Microsoft 365 tenants want to impose the same retention period for Teams chats and Copilot interactions.
Microsoft recommends that developers move from the older DirectoryRoles Graph API and use the UnifiedRoleDefinition API instead. Changing APIs will impact the code in any PowerShell scripts used to automate role assignments. In this article, we review some examples of the older way to assign roles and show how to do the same tasks with the new API.
Microsoft launched private channels in November 2019. A lot has happened since, and private channels don’t really get much attention these days. That’s a pity because private channels can be very useful in the right situation. I rediscovered this fact recently when working through an issue with a university where private channels were the right answer. Like all technologies, happiness comes from choosing the right tool.
A recent article about analyzing interaction records for Microsoft 365 Copilot led to the question if it’s possible to do the same for Microsoft Copilot. After checking the compliance records captured by the Microsoft 365 substrate, we discovered that Microsoft Copilot generates compliance records. However, a bug with encoded text means that the information captured for responses from Microsoft Copilot and Microsoft 365 Chat isn’t visible. All explained here.
Microsoft announced Delicensing Resiliency, a new feature for tenants with over 10,000 paid seats, to avoid inadvertent data loss due to licensing errors. Essentially, the feature adds an extra 30-day grace period post license removal during which mailboxes work as normal. The idea is that administrators will have extra time to detect and fix licensing errors that lead to mailbox removal. Overall, the new feature seems like a great idea (for large tenants).
Container management label support is coming to the Loop app. Before it arrives, we look at how Loop supports sensitivity labels assigned to pages in Loop workspaces. As you might imagine with the initial implementation of a feature, some gaps are obvious that the Loop developers should fix as they build out full support for sensitivity labels within the Loop ecosystem.
Group-based licensing is a mechanism to make it easier to assign and manage product licenses for large sets of user accounts. In this article, we discuss how to use Microsoft Graph PowerShell SDK cmdlets to manage group-based license assignments in a Microsoft 365 tenant. Assigning licenses to groups is very much like direct assignments, but some differences exist.
Monthly Update #113 (November 2024) for the Office 365 for IT Pros eBook is now available for download by current subscribers from Gumroad.com. An update is also available for the Automating Microsoft 365 with PowerShell eBook. In other news, we look at the Microsoft 365 news from Microsoft’s FY25 Q1 results and try to interpret what some of Microsoft’s statistics really mean.
Copilot agents are part of Microsoft’s Wave 2 initiative launched in September 2024. Basically, an agent restricts Copilot queries to a defined set of content, meaning that the response generated by Copilot is much more precise and won’t be affected by information found in other sites. The wizard makes it very easy to create a new custom agent. Some features are missing, but they’re on the way.
A reader asked why the Entra admin center includes an option to manage per-user MFA settings for accounts. I don’t know why Microsoft added this option, but it doesn’t take away from the strategy to enforce and manage multifactor authentication through conditional access policies. Microsoft has been very focused on CA policies for the last few years and per-user MFA will eventually be subsumed into the CA strategy.
Many articles describe how to disable a service plan for a product license assigned to a Microsoft 365 account, but few cover how to enable service plans should the need arise afterward. This article covers the basics of disabling and enabling service plans for Microsoft 365 licenses using PowerShell, including the very important step of finding existing disabled plans. Everything’s easy once you know how.
A reader asked how to find emails with sensitivity labels. Everyone knows that you can find SharePoint files protected by sensitivity labels, but what about emails? MAPI properties exist that hold details of sensitivity labels. These properties are promoted to Microsoft Search, and this allows features like end-user searching through the Microsoft 365 app and Outlook to work. But the best way to find emails with sensitivity labels is to use a Purview content search.
An October 17, 2024 report highlights how Microsoft 365 Copilot can benefit SMEs in terms of increased revenue and ROI. But the report is a marketing tool designed to sell more expensive Microsoft 365 Copilot licenses. There’s a certain fear of missing out that’s presented by the report but spending a large amount on licenses without knowing exactly where the return will come from has never been a good business tactic.
Directory synchronization features control how the Entra Connect tool works when synchronizing accounts from Active Directory to Entra ID. The current advice is to use a cmdlet from the depreciated MSOL module to update settings. This article explains how to do the job with the Graph APIs, including cmdlets from the Entra PowerShell module.
A recent question asked how to force users to reauthenticate at 7AM every Monday. The solution seems to revoke access for user accounts. This article describes how to create an Azure automation runbook (PowerShell script) to find target accounts and revoke their access. By linking the runbook to an automation schedule, we can make sure that revocation happens at the desired time.
A new Cloud Licensing API has turned up in the Microsoft Graph beta endpoint. Apparently, the new API aims to improve license management in various ways. For now, the new API returns essentially the same licensing data that’s available through other APIs and cmdlets. The full story about what problem Microsoft plans to solve with the Cloud Licensing API and usage rights remains to be seen.
Container management labels are an effective way to ensure that groups, teams, and sites have the right settings. The Graph doesn’t support custom attributes for groups, so these attributes aren’t available to store details of the “approved” container management label to check if anyone has changed the label after the original assignment. Time to find a new way to store this data.
Copilot errors in generated text can happen for a variety of reasons, including poor user prompts. If the errors end up in documents, they can infect the Graph and become the root cause for further errors. Over time, spreading infection can make the results derived from Graph sources like SharePoint Online unreliable. Humans can prevent errors by checking AI content thoroughly before including it in documents, but does this always happen?
The Teams calendar app is being refreshed in November 2024 when Teams takes on the calendar UI used by OWA and the new Outlook for Windows. The unified Microsoft 365 calendar experience is based on OPX and WebView and looks much better than the old Teams calendar. It makes perfect sense for the same UI to manipulate the same calendar data in both Outlook and Teams.
Copilot Pages are part of the September 2024 Copilot Wave 2 announcement. They’re a good way to capture the text generated by Copilot in response to a prompt. Each Copilot page is a Loop component stored in a SharePoint Embedded container. Figuring out how to manage these containers will take a little time, especially as Microsoft hasn’t yet delivered the APIs needed to do the job.
Adaptive searches are a nice way to target users, sites, and groups for Purview retention processing. But a user adaptive scope can’t select members of a group and target them. That is, unless you use the same attribute to identify users for both a dynamic group and an adaptive scope, which is what’s explained here.
The Exchange admin center feature to allow administrators to initiate an upgrade distribution list process to request group owners to migrate distribution groups to Microsoft 365 groups is terrible. In my experience, the request goes into a black hole and never emerges, or the process fails immediately. But you shouldn’t be upgrading distribution lists to Microsoft 365 groups anyway because groups are often overkill when all that’s needed is a way to distribute email to multiple recipients.
The question of how best to write PowerShell for Microsoft 365 was asked during a TEC 2024 PowerShell workshop. There are many variables, and one has the right answer. To start the ball rolling, this article describes how I write PowerShell for Microsoft 365 using a variety of modules such as Exchange, SharePoint, Teams, and the Microsoft Graph PowerShell SDK.
Offline access is a fundamental feature for email clients. The new Outlook introduced initial support in June 2024. Now it can start without a network connection, which is something that Outlook classic has been doing for 27-odd years. The update provoked a search for where the new Outlook stores the data used when working offline, and we think we know where the data is.
Microsoft announced blocked Teams federated chat for trial tenants in June 2024. That block is now well and truly enforced. If you use an account in a trial tenant (and many flavors of these accounts exist), then you won’t be able to set up a federated chat with someone in another Microsoft 365 tenant. It’s an example of how Microsoft restricts service functionality to stop misuse.
The Delve browser app retires on December 16, 2024. It’s time to check if the change will affect how people interact with user profiles in Microsoft 365 tenants. A new “user profile experience” is due to arrive in November that should allow people to update details in their profile. Hopefully, the new experience will include photo updates, which have long been a problem area for Microsoft 365 apps.