The Ultimate Guide to Mastering Microsoft 365
The Maester tool is a great way to get a security assessment for a Microsoft 365 tenant. Being able to create custom Maester tests makes it even better. In this article, we explain how to create a custom Maester test that reads the Entra ID Groups policy to report if users are allowed to create new Microsoft 365 groups (and teams).
Unsurprisingly, Microsoft announced the deprecation of the Revoke-SPOUserSession cmdlet for November 2024. The cmdlet is replaced by the Revoke-MgUserSignInSession cmdlet, which works across Microsoft 365 rather than just SharePoint Online. All of this happened while the 2nd annual PowerShell Script-Off happened at TEC 2024 and competitors struggled with what to do to secure a user account for an ex-employee.
SharePoint Advanced Management (SAM) is a $3/user/month add-on that can help Microsoft 365 tenants manage problems like oversharing, data governance, and site lifecycle. A TEC 2024 session describe how SAM can help tenants cope with these issues in the AI era.
The Outlook (classic) client has a registry setting to control moving deleted items from a shared mailbox. The new Outlook for Windows client doesn’t have an equivalent setting, so items removed from a shared mailbox end up in the Deleted Items folder of the user’s mailbox rather than the Deleted Items folder in the shared mailbox. It’s an example of one of the things to fix before the new Outlook can take over.
The Office 365 for IT Pros team is delighted to announce the availability of monthly update #112. Subscribers for the 2025 edition can now download the updated files from Gumroad.com. We’ve also updated the Automating Microsoft 365 with PowerShell book, which is included as part of the Office 365 for IT Pros bundle and availanle separately, including as a printed version. We’re now working on monthly update #113, due on November 1, 2024.
Following a change made to Microsoft Synchronization Technology to support the new Outlook for Windows, Outlook mobile supports access to archive mailboxes. For mailboxes enabled with an archive, the archive mailbox is listed like other mailboxes and opened in the same way. The only thing to remember is that archive items tend to be old and therefore you’ll probably have to instruct Outlook to download the items to the device.
TEC 2024 (aka “The Experts Conference”) takes place on Oct 1-2 at the Loews Arlington Hotel. TEC is a great conference for many reasons, notably the intensely practical nature of the coverage technology receives during conference keynotes, sessions, and workshops. If you’re looking for a high-quality event to attend in 2025, put TEC 2025 on the list.
Some organizations want to disable OneDrive for Business to force people to use SharePoint Online. This might have been possible in the past. It isn’t practical now because of the way that Microsoft has concentrated personal storage for Microsoft 365 apps in OneDrive for Business. It’s a better idea to come up with some practical methods to ensure that valuable information is recovered from OneDrive on an ongoing basis.
MC894577 announces that DLP policy tips displayed in Outlook will soon support a set of new conditions. That’s good, but the text of the announcement is unclear about important points like the clients that will support the new policy tips, what kinds of groups are supported by the conditions, and precise details of how Outlook will differentiate between users with Office 365 E3 and E5 licenses.
An article described some benefits that could be gained from not installing the complete Microsoft Graph PowerShell SDK. The question is whether the claimed benefits are more theoretical than actual. It’s hard to say because it all depends on how someone uses the SDK for development or to run scripts. Anyway, it’s a topic worth discussing.
A recent script demonstrated how to import contacts into user mailboxes using a list in a SharePoint site as the source. With a quick change, a CSV file becomes the source. This is a great example of how adaptable PowerShell is and how to update code found in articles to meet your needs. If you do ask an author to change their code, remember to try to make the change yourself first, and if you fail, explain to the author why the change should be made.
The new Outlook for Windows and OWA now can suppress duplicate contacts. This means duplicate contacts are hidden, not removed. Tests reveal that duplicate suppression does work and probably does well in most cases. However, the lack of documentation around when suppression occurs and how decisions to suppress are made mean that Microsoft has some work to do here.
Microsoft’s advice is to use the Get-ExoMailbox cmdlet instead of its older Get-Mailbox counterpart. Generally, this is good advice that you should follow. However, the older cmdlet can do a job in certain circumstances, so don’t write it off completely. More importantly, make sure that filtering of objects is done using server-side filters. This will improve script performance significantly.
Sometimes you don’t need the full-fledged Graph API to report details of items in Recoverable Items and the Get-RecoverableItems cmdlet can do the job. The data fetched by the cmdlet isn’t as rich as the information available through the Graph, but if all you want is a simple listing of what’s in a mailbox’s Deletions folder, Get-RecoverableItems is a good solution. And best of all, we provide a full script to show how.
This article explains how to use the Microsoft Graph PowerShell SDK to report Recoverable Items in a form that is usable for eDiscovery investigators and other highly-privileged use. The script fetches details of items found in folders like Deletions, Purges, Versions, and SubstrateHolds. Because accessing mailbox data is a sensitive action, consider restricting access to confidential mailboxes using RBAC for applications.
A new Entra ID photo update settings policy aims to cure the mish-mash of existing settings controlling how user profile photos are updated in Microsoft 365. The new policy is based on a Microsoft Graph resource. Work is needed to update clients to respect the policy settings and take over from current controls, like the OWA mailbox policy.
In MC877369, Microsoft announced the availability of three Copilot usage reports in the Graph usage reports API to track usage of Copilot for Microsoft 365 in the apps enabled for Copilot, like Outlook, Excel, Word, PowerPoint, Loop, etc. The data available in the Copilot usage reports isn’t very informative and you might be better off using audit records to analyze what’s happening.
The Microsoft 365 Licensing Report PowerShell script has been upgraded to generate detailed license information and to deal with expired license subscriptions. You can download V1.94 of the script from GitHub. Before attempting to run the licensing report script, take the time to read previous articles to understand the basics of the script and how to generate the files used for pricing information.
The Microsoft 365 admin center will support continuous access evaluation (CAE) from September 2024 to help revoke access from accounts more quickly when critical events happen (like an account password being changed). Adding CAE support to an admin center is always a good idea, but it shouldn’t take away from the need to protect Microsoft 365 accounts with multifactor authentication. Stop compromise before you need to react to compromise!
eDiscovery is a calling best left to skilled investigators. But Microsoft 365 administrators need to know how to search and how the new Purview eDiscovery works. The new implementation is due by the end of 2024 and is in preview now. It unifies the three existing solutions in the Microsoft 365 eDiscovery space and promises to deliver new functionality. But will it make its dates? Who knows!
One of the things that vexes me is the need to change account to attend a Teams meeting. I forget this all the time and end up with unexpected waits in virtual lobbies, twiddling my thumbs while waiting for someone to admit me to the call. Sometimes I end up missing calls because people can’t admit participants from outside the tenant if they don’t have a guest account. The solution might come from the application of more intelligence and a change to the Teams UI.
The automatic document summary feature for Word duly turned up and Copilot for Microsoft 365 has been busy generating summaries ever since. The feature works well for documents with less than 80,000 words, which should be enough for most documents but limits summarization for documents that might use it most, like complex plans or contracts. In any case, I haven’t found a way to turn document summaries off. Maybe that’s coming.
Thankfully, Teams pasted text no longer contains a timestamp and the author’s name. The change is effective worldwide and addresses a longstanding irritation. Quite why it took so long for Microsoft to understand how people felt about the insertion of unwanted metadata is a mystery, but it’s gone now. And in other news, Mic Pending is a new feature for Teams calls and meetings.
People often need to transfer objects or code between Microsoft 365 tenants. When it comes to dealing with objects, the Microsoft Graph PowerShell SDK’s ToJsonString method is very useful. The method outputs a string containing JSON content, but only for object properties that have a value. This makes the much easier to use the output as the basis for a template object or as the payload body to create an object in another tenant.
Files are available to download for the September 2024 update for the Office 365 for IT Pros (2025 edition) eBook. This is monthly update #111 for the only book covering Microsoft 365 that’s updated monthly. As normal, this update covers a bunch of new information and insights from across the Microsoft 365 ecosystem.
After reaching 50% deployment and on track to general availability, Microsoft decided to withdraw the Copilot catch up feature. Catch up shows a set of cards in a carousel to highlight documents and other items that Copilot believes are of interest to the user. It’s like the insights surfaced in other places within Microsoft 365, such as Office applications, Viva Insights, and Delve.
On August 21, 2024, news emerged that the PnP PowerShell module will transition from using a multi-tenant Entra ID app to a tenant-specific app. The change is scheduled for September 9, 2024, which doesn’t leave a lot of time available for developers to review, update, and test PowerShell scripts based on PnP PowerShell. Some extra warning would have been nice.
The ability to restore deleted groups only covers Microsoft 365 groups. That’s an odd situation to be in given the different types of groups in Microsoft 365, and the reasons why things work (or don’t) the way they do is down to history and different teams within Microsoft. It’s logical that customers assume they can restore any type of deleted group. Microsoft needs to do some magic to make that assumption real.
Microsoft Purview and the Exchange Online Search-UnifiedAuditLog cmdlet both perform searches of the Microsoft 365 unified audit log. Both mechanisms support the concept of scoped searches to limit audit records returned by searches to the administrative units an account can manage. But the permissions assigned by the two mechanisms aren’t synchronized, which can lead to complications.
Shared mailboxes have Entra ID accounts. No one needs to sign into the accounts because Exchange Online manages connections using mailbox permissions. But it can happen that people do sign into shared mailboxes and if the accounts aren’t licensed, they don’t comply with Microsoft licensing requirements. As explained here, some PowerShell can check for potential licensing violations.
Microsoft says that they plan to refresh the Teams external domain activity report from September 2024. But access to the report requires a Teams Premium license. It seems like this kind of fundamental information should be available to every tenant as it’s not basic security data instead of something that could be considered as Advanced Collaboration Analytics.
Microsoft announced their plan to charge for unlicensed OneDrive for Business accounts in July. Now we have an unlicensed OneDrive accounts report in the SharePoint Online admin center. The report divides unlicensed OneDrive accounts into four categories and it’s up to Microsoft 365 tenant administrators to figure out whether to retain or remove unlicensed accounts before automatic archival comes into force in January 2025.
The decision to rationalize license management in the Microsoft 365 admin center wasn’t popular but the signs are that it could deliver benefits to customers in the form of new features and functionality. The first updates are a GUI to manage self-service purchases and trials together with notifications to administrators when a user makes a self-service purchase. More needs to happen, but positive indications are there.
A recent report highlighted the problem of on-premises accounts synchronized to Entra ID that receive administrative role assignments. This article explains how to report the administrative role assignments managed by Privileged Identity Management (PIM) or direct role membership so that it’s easy to highlight on-premises accounts holding administrative roles.
Microsoft’s project to impose a mandatory MFA requirement for access to Azure management tools and sites will start enforcement on or after October 15, 2024. The new requirement will only affect administrator accounts who access Azure sites and tools (like PowerShell). Normal users shouldn’t notice any difference. The Azure MFA requirement is a great way to drive home the need for MFA to protect Microsoft 365 administrator accounts against attack. Prepare now!
The August 15 announcement that Microsoft Copilot (the version that doesn’t use the Graph) will benefit from enterprise data protection from September is good news. However, Microsoft said nothing about the security issues around Copilot for Microsoft 365 reported at the recent BlackHat USA 2024 conference. In other news, tenants can pin Microsoft Copilot to app navigation bars using a new control in the Microsoft 365 admin center.
The Usage Reports Graph API is now generally available, which means that it’s fully supported. In other news, a Graph API is available for Microsoft 365 Backup, The news demonstrates once again how widely the Graph APIs are used with Microsoft 365 and why tenant administrators should acquire some knowledge about how the Graph works.
The AuditLog Query Graph API remains in beta status but cmdlets are now available in the Microsoft Graph PowerShell SDK. This led to some oddities in results when the number of audit events found by a search didn’t match those reported by the Purview compliance portal. It all worked out in the end. In other news, the Set-MgRequestContext helped sort out some retry problems.
HVE and ECS are two competing Microsoft Cloud Email Services. At least, they seem to compete. In reality, HVE and ECS serve different target audiences. HVE is all about internal email services for apps and devices while ECS is for high volume external mailings like customer newsletters. We tested both services by sending subscription reminder notifications to Office 365 for IT Pros readers.
