Quantcast
Channel: Practical 365
Viewing all 543 articles
Browse latest View live

Microsoft is Changing the Groups Behavior to Stop Senders Receiving a Copy of Their Own Message

$
0
0

A new notification appeared in my Message Center email digest to let me know that Microsoft is rolling out a change to the behavior of Office 365 Groups.

We have recently fixed the email sending behavior to a group, where senders had complained about receiving the emails they send to a group, back in their personal inbox. With this fix, senders will no longer receive the emails they send to a group in their personal inbox.

The primary complaints we heard were about reading the same message users sent to a group multiple times – in their sent messages and their inbox. This fix makes it convenient for those users who have a habit of adding themselves to CC to keep track of their sent messages in inbox.

We are rolling out this fix now, and it will be completed by the end of February.

A few days ago, a Reddit user posted the following:

I have had an influx of people complaining that when they send a message to a 365 group, they no longer get a copy of their own message. Does anyone know what is causing this and how to make it go back to it’s original behavior?

Office 365 Groups provide the option for users to subscribe to receive a copy of emails that are sent to the group. The option is available in Outlook and OWA.

Subscribing to a Group in Outlook
Subscribing to a Group in OWA

Before this change was rolled out, if you emailed a Group that you were also subscribed to, you received a copy of your own email message just like everyone else who is subscribed to the group. As Microsoft points out, this is inconvenient for people who are in the habit of CCing themselves on their own emails, a habit which I find strange given that your email will be easily found in your Sent Items, and any replies will still reach you whether you CC yourself or not.

Apparently the complaints (none of which I could find on Uservoice) were loud enough to prompt Microsoft to roll out a change for all customers. The fresh complaints about the changed behavior only go to show how difficult it is to please everyone when you are delivering a cloud service to millions of customers. The obvious middle ground would have been to modify the subscription options to allow users to choose whether they wanted to receive copies of their own messages or not. Perhaps the engineering to make that possible was too challenging or risky.

In any case, if you’re curious why your users are seeing different behavior, now you know the reason.

The post Microsoft is Changing the Groups Behavior to Stop Senders Receiving a Copy of Their Own Message appeared first on Practical 365.


Simplifying Office 365 License Control with Azure AD Group-Based License Management

$
0
0

Managing the allocation of Office 365 licenses has been a pain point for many customers. For smaller tenants with simple requirements, the allocation of licensing can either be handled manually on an as-needed basis using the Office 365 admin portal, or built in to a provisioning script or system. For larger tenants, automation is essential, as manual methods are far too time-consuming for any environment with a high rate of change (e.g. dealing with new and departed users, or licensing sub-features and extra applications). In fact, quite a few Office 365 customers have remarked to me recently that managing licenses is one of their biggest challenges, and they’ve invested quite a lot of time into scripting solutions based on Active Directory group membership.

Well the good news, or perhaps bad news considering the investment of time they’ve already made, is that Microsoft has now released Azure AD group-based license management for Office 365. The feature is currently in Preview.

Getting Started with Azure AD Group-Based License Management

Microsoft has made group-based license management available through the Azure portal. Choose Azure Active Directory from the list of services in the portal, and then select Licenses.

The groups that you can assign licenses to can be created in Azure AD, or synchronized from on-premises Active Directory. The license assignments can be static (i.e. to the members of a group) or dynamic (e.g. based on user attributes such as ExtensionAttribute1). For this demonstration I’m using groups synchronized from on-premises Active Directory with static membership.

The groups I have created will allow me to demonstrate basic license assignment, as well as a more granular approach, and how license assignment is cumulative for users who are members of multiple groups. I’ve created groups named:

  • Licensing_Office365_E3_Base
  • Licensing_Office365_E3_Teams
  • Licensing_Office365_EMS_E3

My goals are:

  • To assign Office 365 E3 licenses with what my organization considers “base” functionality, which is all E3 features except for Yammer, Sway, StaffHub, and Teams
  • To assign Teams access only to specific users in the organization, due to Teams currently being in Preview
  • To assign EMS (Enterprise Mobility + Security) E3 licenses to specific users only

My tenant currently has licenses assigned to users, so I will need to transition users from direct license assignment to groups-based licensing without disrupting their existing services (e.g. Exchange Online mailboxes).

Assigning Licenses to Groups

After navigating to the Licenses section of Azure Active Directory in the Azure portal, you can view the list of products that your organization currently has licenses for.

Select a product license and click on the Assign button. From the Users and Groups selection, choose the group that you want to assign licenses to, and then click on Select. You can select multiple groups at this stage, for example if you were using department-based groups to assign product licenses to users. I am using product-based groups instead. Either approach will work, it really just depends on how your organization views license management.

In the Assignment options you can select the sub-features for the license that you’ve chosen to assign to the group. I’ve turned off StaffHub, Teams, Sway, and Yammer for this demonstration.

Click OK when you’re happy with your selections, and then click Assign to create the license assignment. If there’s any errors at this stage you’ll receive a notification in your Azure portal. On my first run through this feature I was getting a notification that “Licenses could not be assigned or removed due to an error”, which I was unable to work out a solution for.

It appears that the problem was that I was using a Microsoft Account associated with my Azure subscription, and even though the account has access to the Office 365 tenant’s Azure AD (and is a Global Admin) it is not able to be used for administering groups-based license management. Logging on to the Azure portal with the Office 365 tenant admin account allowed me to continue without errors. A strange issue that might impact partner or delegated permissions scenarios, but nonetheless I was able to proceed with the correct account.

After completing the steps above I went back through the same steps to create a license assignment for Teams only, and another for EMS E3. For Teams, I created a license assignment that only enables Teams, which will allow me to fully demonstrate the cumulative nature of groups-based license management.

Transitioning from Direct to Groups-Based License Management

A few minutes after setting up my group license assignments the Azure portal showed my users’ license status as below. Notice how most of the users have both direct and inherited assignment paths. The names of the groups that licenses are being inherited from, such as Licensing_Office365_E3_Base, are also displayed. Notice also that most users have the fully 13/13 services included in an E3 license showing as enabled.

To transition from direct to groups-based licensing, all we need to do is remove the direct license assignment. This is as simple as selecting one or multiple users who are assigned a specific type of license, and then clicking the Remove button. In the example below, the list of E3 license holders is shown, and I’m removing the direct assignment from the users who also have an inherited assignment via a Group.

After clicking Remove you’ll get one final prompt before the change is made.

This transition is best performed in stages so that you can be confident that you’re not disrupting your users’ access to services. If you’re transitioning a full E3 direct license to a full E3 group-based assignment, then the risk is fairly small. However in cases where you’re adjusting the number of services that the user has access to, you should be more cautious.

Cumulative License Assignments

As I mentioned already, I am using multiple groups to assign licenses. Most of the users in my organization will have a subset of the E3 license features, and a select few will also get access to Teams. After removing the direct license assignments, the groups-base licensing is in full effect. You can see below that:

  • Users who are only members of the Licensing_O365_E3_Base group get 9/13 services, for example Alannah Shaw
  • Users who are members of both Licensing_O365_E3_Base and Licensing_O365_E3_Teams get 10/13 services, for example Dave Bedrat
  • Users who are only members of the Licensing_O365_E3_Teams group get 1/13 services, for example David Abbott

 

This is the level of control that customers have been asking for, so it’s great to see Microsoft delivering on it.

The license assignments are also visible in the Office 365 admin portal, and reflect the same sub-feature license assignment that you can see in Azure. For example, Alannah Shaw has access to most E3 features except for Teams, Sway, StaffHub, and Yammer.

 

FAQs, Limitations and Caveats

Group-based license management is currently in Preview, and as I’m writing this article the following limitations and caveats apply:

  • The features, behaviors, or availability of group-based license management may change between now and when it becomes generally available.
  • If a user is assigned a license directly as well as via group membership, they only consume a single license.
  • An Azure subscription (trial or paid) is currently required to use group-based license management.
  • Although new and modified license assignments take effect within minutes (e.g. enabling Sway in an existing license assignment), there are situations where a license will not assign automatically, for example if you have more members of a group than available licenses, or when license assignments conflict. Notifications in the portal will advise you of how to remediate the issues, and there’s a Reprocess button available as well to reapply assignments after fixing issues.
  • Membership changes to groups synchronized from on-premises Active Directory will not take effect until after the next sync cycle.
  • Users can have a mix of direct and group-based licenses assigned, for example an E3 license that is group-based, and an EMS license that is directly assigned. Group-based license assignments can only be managed via the Azure portal, and will cause an error if you attempt to modify them via the Office 365 admin portal (at least for now).
  • When new sub-features (or sub-SKU features) are released, Microsoft may enable them automatically by default, requiring you to revisit your group-based license assignments to disable new features from time to time. This should encourage you to keep your group-based license assignments as simple as possible.
  • Nested groups are not currently supported.
  • Removing a user from a license group will result in services being set to a “suspended” stage instead of disabled. Microsoft is using this approach to avoid data loss issues due to accidental removal of group members. You can expect in future that suspended services will eventually age out to a disabled state and data will eventually purge as it does today for de-licensed users.

The post Simplifying Office 365 License Control with Azure AD Group-Based License Management appeared first on Practical 365.

What’s New in Office 365 for February 2017

$
0
0

Office 365 for IT Pros, 3rd Edition is continually updated with new information, changes and corrections. Customers who bought the book from this website can download the updated files from their purchase history. Updates applied to the Amazon Kindle version are available through your Kindle library after they are approved by Amazon.

February is the shortest month of the year, and yet Microsoft has packed another big set of changes into Office 365. First out of the gate for February was the new Service Health Dashboard, providing some nice visual improvements as well as the opportunity to give feedback on the timeliness and accuracy of service alerts. More improvements are planned, including an Office 365 road map item to add email and text notifications to the Service Health Dashboard. Hopefully this will be available to all customers, unlike the Message Center email alerts which we recently learned are limited to tenants of +50 users, at least for now.

Speaking of the Office 365 Roadmap, it’s now been updated to a new design that presents information about feature development and deploying in a way that is easier to read and follow.

Outlook mobile turned 2 years old, and celebrated by releasing new add-ins for Evernote, Trello, and more. The add-ins provide useful functionality such as clipping emails into Evernote notebooks, or associating emails with Trello boards. The integration of third party apps with Office 365 is very often a security and governance concern for customers, so Microsoft also added policies to Intune to allow the add-ins to be controlled if necessary.

On the security front, Microsoft also made Office 365 Secure Score generally available, providing customers with a score-based analysis of the available security features in Office 365 that have been configured for a tenant. I’ve written about Secure Score here before, and also recently answered a reader question on whether Secure Score alerts you to intrusions or breaches. They’ve also released two new Preview programs, both due for general availability this quarter. Office 365 Threat Intelligence aims to help customers stay aware of cyber threats by using data collected from Microsoft’s datacenters and online services. Office 365 Advanced Data Governance is all about reducing risks by identifying sensitive data in your tenant that needs preserving or protecting, while also identifying redundant data that should be removed.

Microsoft Teams is about to move out of Preview and into general availability. Microsoft has issued another notification in the Message Center that Teams will be turned on by default for all tenants, which is their normal approach for new feature deployments. The capability to manage Teams on a per-user basis has been available for some time now, so if you don’t plan to use Teams and want to keep it turned off for now you’ll need to configure your users’ licenses to disable it. Which is a perfect opportunity to check out the new Azure AD group-based license management features that have also been released in Preview.

The world of SharePoint got a little more exciting… with the general availability of the SharePoint Framework announced. For the non-developers (like me) and non-SharePoint folks (also me), the SharePoint Framework is… “a Page and Part model that enables fully supported client-side development, easy integration with the Microsoft Graph and support for open source tooling.” I’m sure that a SharePoint expert will correct me here if I’m wrong, but the world of web development today focuses heavily on Javascript and client-side code, whereas SharePoint development has previously been a server-side endeavor using .NET languages. The new SharePoint Framework brings development and customization for SharePoint into the modern era. For IT pros this might mean an uptick in cooperation with SharePoint developers in the near future.

Office 365 Groups have had an adjustment to their behavior for emails sent to groups by members who are also subscribers for the group. The sender will no longer receive a copy of their own message, which came as a surprise to some users, but is a change designed to please the majority of customers.

Finally, from the More Ways to Create Office 365 Groups department, the roll out of Office 365 connected Yammer groups has begun. This applies to customers who have enforced Office 365 identity for their Yammer users, and who have only one Yammer network associated with their tenant. With this change, when a new Yammer group is created, an Office 365 Group is also created, including resources such as a SharePoint doc library, OneNote notebook, and Planner plan.

Stay up to date with Office 365 for IT Pros.

The post What’s New in Office 365 for February 2017 appeared first on Practical 365.

Exchange Online Advanced Threat Protection Dynamic Delivery Behavior with Journaling

$
0
0

In January of this year Microsoft added two new features to Advanced Threat Protection for Exchange Online. One of the new features, called Dynamic Delivery, provides an additional option that administrators can configure for the delivery of emails while ATP scanning of attachments is occurring.

To set the scene for those who might be unfamiliar with ATP, when ATP’s Safe Attachments feature scans email attachments for signs of malicious behavior, it causes a short delay before the email is delivered to the destination mailbox. This is not simple signature-based scanning, this is a behavioral analysis that opens the email attachment in a sandbox environment, so naturally it will take some time. I’ve seen delays of 1-2 minutes, all the way up to 10-12 minutes. But that’s only noticeable when I’m actually expecting an email with an attachment, such as when I’m in a discussion with someone and they send me a document to look at while we are talking.

Of course, that delay is not always acceptable for some customers. Perhaps the file attachment is less important than the contents of the email itself, and they’d prefer to receive the email promptly and wait for the attachment. That’s where Dynamic Delivery comes in. With Dynamic Delivery enabled, the recipient of the email receives the message in their inbox, but with the original attachments replaced by a message explaining that ATP is still scanning the files.

When the ATP scan has completed, assuming the file is safe, the message is replaced in the mailbox with the real attachments.

You can see a more detailed look at the Dynamic Delivery behavior in Tony Redmond’s article on Petri. What I want to cover here is something that a customer raised to me as a concern when they were considering turning on Dynamic Delivery.

This customer uses journaling as part of their overall compliance and archiving strategy. As you’re probably already aware, Exchange Online mailboxes can’t be used as journaling targets. The reasons are fairly obvious to anyone who has ever managed a journal mailbox. They grow very big, very fast. The economics and support implications just make it unreasonable to expect Microsoft to deal with thousands of exploding journal mailboxes for customers. At least not for the price we’re currently paying for Exchange Online.

So this means that the customer needs to use an externally hosted email address as the journaling target, provided by a third party cloud-based journaling service, or hosted on their own on-premises server. Since the journal mailbox is not hosted in Exchange Online, Dynamic Delivery can’t make changes to a delivered message (i.e. to redeliver or re-inject the attachment) the same way it can for an EXO mailbox. Meanwhile, the expectation of the customer is that their journaled copy of emails will match what was delivered to the recipient. The concern from the customer is that the journaled item will be a copy of the message at one point in time, but the message is then modified by Dynamic Delivery.

I did a little testing to see what would happen with Dynamic Delivery and external journal targets, and here’s what I found.

First, when ATP is not enabled for Dynamic Delivery, the external journal target sees the same delay for delivery of a message as the recipient themselves. In other words, ATP delivers to the recipient and to the journal address after completing its behavioral analysis (that 2-12 minute delay I mentioned earlier).

When Dynamic Delivery is enabled, the behavior changes. Both the recipient and the journal target receive the email almost immediately. The recipient’s copy is missing the attachments while ATP continues its analysis, but the journal target receives the attachments intact. Several minutes later, when the ATP scan is complete and Dynamic Delivery updates the message in the Exchange Online mailbox, no changes are sent to the journal target. In other words, the journal target receives only one copy of the email message, with attachments included, regardless of the ATP scan results or subsequent Dynamic Delivery behavior (which could include removing the email messages from the recipient’s mailbox).

A look at a message trace in Exchange Online shows the sequence of events.

As you can see above, the journal events occur before the dynamic email delivery event. So the email I sent during my test was journaled, and then delivered to the recipient without the attachments, and then only after ATP completed its scans did Dynamic Delivery update the delivered message several minutes later.

For your own assessment of the suitability of Dynamic Delivery, you should consider the behavior above and whether it impacts your compliance and archiving strategy. I would assume that for most organizations it will not be an issue, since Exchange Online still journals the complete message to the external journaling service. Any subsequent actions taken by ATP can be found in the message trace results for up to 90 days. If there’s concerns about cases older than 90 days not being available in message tracing, you may need to review your use of preservation policies, litigation hold or in-place hold and how you utilize Office 365’s eDiscovery tools for such matters.

The post Exchange Online Advanced Threat Protection Dynamic Delivery Behavior with Journaling appeared first on Practical 365.

Exchange Server 2007 is About to Reach End of Life – What’s Your Plan?

$
0
0

On April 11th this year, Exchange Server 2007 will reach the end of its support lifecycle, otherwise known as end-of-life. For customers still running Exchange Server 2007, you should start making plans now to migrate to a newer version of Exchange, or to Office 365. In fact, I’d love it if you would take a moment to answer my poll question to share what your plans are. Click here to take the poll (only one question, won’t take long at all).

Exchange Server 2007 Service Pack 3 (the last service pack that was released in June of 2010) reached the end of mainstream support in April 2012. When mainstream support ends, products go into an extended support phase for another few years. Products in extended support usually receive no further feature updates, but continue to receive security updates and some bug fixes. The extended support period for Exchange 2007 ends on April 11th, 2017. After extended support expires, the product received no further updates at all.

The release of Exchange Server 2007 (on March 8th, 2007 according to TechNet), marked a significant milestone for the Exchange Server product, as well as for my own career. Exchange 2007 was a big shift from previous versions of Exchange, moving to a 64-bit architecture, separate server roles, PowerShell administration, and giving us the first use of log shipping for database replication that is now such an important part of the Exchange Server and Exchange Online high availability architecture.

When Exchange 2007 arrived on the scene I was working as a generalist server administrator, and had just moved from a managed service provider to a project/consulting role. My manager at the time gave me a few options for specialization. I could focus on SCCM (which I’d been dealing with since SMS 2.0), SharePoint (which was just starting to show some momentum in the enterprise, and looked challenging), or Exchange. I had worked with Exchange since 5.5 through my various support roles, and we happened to have more Exchange projects in the pipeline than anything else (plus I was a little burned out on SCCM, since I was generally called in to fix completely broken implementations), so I agreed to focus on Exchange. In hindsight, I feel like I made the right choice.

Over the next few years I migrated lots of customers to Exchange Server 2007, with a variety of deployments including some CCR clusters and at least one SCR (Standy Continuous Replication) deployment, which I actually had to activate for that customer after they duffed their primary server one day. Along the way I started blogging about Exchange Server on a personal blog, which eventually turned into Exchange Server Pro, and has now evolved into Practical 365 (which you’re reading right now).

I embraced PowerShell early when I realized how much easier it would make my server deployments, and dove in even more deeply after landing a job at one of Australia’s largest Exchange orgs where it would be impossible to manage and troubleshoot the environment without PowerShell. It was in that role that the earliest versions of some of my most widely used PowerShell scripts were developed – Get-MailboxReport.ps1 and Test-ExchangeServerHealth.ps1. Both of them are showing their age today, having being written for an Exchange architecture that has evolved quite a bit over time, but for the most part are still working.

Despite my fondness for Exchange Server 2007 and all the good it has done for me over the years, it is definitely time for customers to move on. Your servers won’t suddenly break when the end-of-life date passes, but running software that has no vendor support is extremely risky. If a serious bug or security vulnerability emerges, or if your server crashes and you need help restoring data or services, Microsoft won’t be able to help you. Finding third party support will also get more difficult as Exchange 2007 skills fade or move on from the job market into other roles.

If on-premises servers are how you still want to run your Exchange, then a migration to a newer version should be planned as soon as possible. Ideally you will migrate to Exchange Server 2016 as the latest and greatest, but that will require a two-stage migration from Exchange 2007 to 2013 first, then Exchange 2013 to 2016.

Your other option is to migrate to Office 365. Email is a good first workload to migrate for organizations who are new to cloud services. There is a migration path from Exchange 2007 to Exchange Online. A hybrid migration is a good option to consider, and Microsoft offers a free “hybrid license” of Exchange 2013 that you can install in an Exchange 2007 organization to facilitate the hybrid connectivity and migration (you just can’t host mailboxes on the free hybrid license). If a customer hasn’t had the time to maintain or upgrade their Exchange 2007 servers for this long, moving to the cloud and making it Microsoft’s job to maintain the infrastructure is an excellent idea. You also get access to all of the other features of Office 365 that don’t exist on-premises, such as Planner, Teams, Office 365 Groups, and many more security and compliance tools.

So don’t delay. Start making those plans. And don’t forget to take a minute to answer my poll, or share your thoughts in the comments below.

The post Exchange Server 2007 is About to Reach End of Life – What’s Your Plan? appeared first on Practical 365.

Time to Prepare for Microsoft Teams General Availability

$
0
0

On March 14th Microsoft will be making Teams generally available for Office 365 customers. Before then, you should review your Teams configuration to make sure that you’re ready.

If you’re planning to use Microsoft Teams in your organization, the good news is that it will be enabled by default for your organization and for each licensed user. So there’s nothing you need to do to turn it on. That said, you might want to review your Teams configuration. In the Office 365 admin portal go to Services & add-ins, then choose Microsoft Teams. Review the configuration to make sure you’re happy with the features and experience that your users will receive.

If you want to limit the creation of Teams, it is controlled in the same way that Office 365 Groups creation is managed. In the example below, the ability to create Groups has been restricted to members of the “Groups Admin” security group in my tenant. This configuration applies to all Groups-based workloads, not just Teams, so you should approach with caution.

PS C:\> Get-MsolGroup | Where {$_.DisplayName -eq "Groups Admins"}
ObjectId                               DisplayName                GroupType
--------                               -----------                ---------
489c22bb-beba-4915-80b0-85c85f4c64e8   Groups Admins              Security
PS C:\> $Policy = Get-MsolSettingTemplate –TemplateId 62375ab9-6b52-47ed-826b-58e47e0e304b
PS C:\> $Setting = $Policy.CreateSettingsObject()
PS C:\> $Setting["EnableGroupCreation”] = "false"
PS C:\> $Setting["GroupCreationAllowedGroupId"] = "489c22bb-beba-4915-80b0-85c85f4c64e8"
PS C:\> New-MsolSettings –SettingsObject $Setting

Note: managing Groups creation currently requires the use of v1.1.130.0 (Preview) of the Azure AD PowerShell V1 module, available here.

If you do not plan allow your users to make use of Teams, you’ll need to disable the licenses for your users. Microsoft provides guidance here, or you can use the new Azure Active Directory groups-based license management to make it easier.

If you want to catch the launch coverage, Microsoft is holding an online event to discuss what’s new in Teams and how customers are already using Teams for collaboration.

The post Time to Prepare for Microsoft Teams General Availability appeared first on Practical 365.

Migrate Home Drives to OneDrive for Business

$
0
0

One of the wins for Office 365 customers who have OneDrive for Business included in their licensing is to migrate users’ personal files to OneDrive.

For files that are stored in home drives on traditional file servers, the reduction in server and storage costs is a benefit. For other personal files stored on local computers, moving the files to OneDrive so that they are safely stored in the cloud is also a benefit.

Generally speaking, OneDrive for Business works well for:

  • “My documents” scenarios
  • Simple sharing of documents between small groups of collaborators
  • Storing data in the cloud where compliance and security can be enforced
  • Syncing files to mobile computers and devices for working offline or remotely

The OneDrive sync client can also synchronize files from SharePoint libraries for offline access to team files. So having it configure and ready to go is useful to end users who travel or work in places with poor connectivity.

In this article I’m going to demonstrate a simple migration scenario for migrating home drives to OneDrive for Business. For the purposes of this demonstration the environment consists of:

  • Office 365 E3 licensed users.
  • Office 2016 (via Office 365 ProPlus) client installations on Windows 10 computers.
  • The “Next Gen Sync Client” (NGSC), also generally referred to as OneDrive.exe, as opposed to the old Groove.exe sync client that has different features, performance, and reliability.
  • User home drives located on a file server
  • Folder redirection for Documents and other well known folders to the home drives

Reviewing Home Drive Data

OneDrive for Business has some limitations for synchronizing files, which includes things like:

  • Invalid characters in file names (e.g. #, %, ?)
  • Specific strings of characters in file names (e.g. COM1)
  • Specific strings in folder names
  • Maximum of 30 million documents per library
  • 10GB file size limit
  • Files names or paths with more than 256 characters

Those limitations may change over time, so you should always review the latest information on Microsoft’s support site. There’s a variety of other limits and user experience caveats to be aware of as well.

But for the file limitations, an analysis of the data your planning to migrate would be advisable. This could be as simple as a PowerShell script that recursively scans the file server to look for the issues above. If you qualify for FastTrack support from Microsoft, that service includes analysis and remediation as part of the process (and you can use them for the entire migration, so you don’t need to read this article at all if you don’t want to).

Reviewing OneDrive for Business Admin Settings

The OneDrive for Business Admin portal allows you to control a variety of settings for OneDrive users, such as whether they are able to share content external to the organization, sync with non-domain joined computers, how files can be used from mobile devices, DLP policies, and more. Before you proceed with your OneDrive migration, it’s worth reviewing the settings to make sure they align with your expectations and security policies.

For example, you might consider it necessary to disable sharing of SharePoint and OneDrive content with external users, or limit syncing of files to domain-joined computers only.

Configuring a Group Policy

OneDrive has a Group Policy template available from Microsoft. The OneDrive GPO can be used to set the default location for the OneDrive folder, among other useful settings. That particular setting, in combination with a standard folder redirection policy, is how I’ll be handling the migration in this environment.

The objective of the Group Policy is to:

  • Create an environment variable representing the OneDrive sync location, so that the variable can be used in the Group Policy folder redirection settings. I’ve used Microsoft’s guidance here. The variable in this example is set to “%userprofile%\OneDrive – Exchange Server Pro”.
  • Create a new folder in the %OneDriveSync% location. This can be achieved with a Group Policy preference.
  • Preventing users from choosing a different OneDrive location on the user’s computer. Note that this requires editing the Group Policy template (ADMX file) in the Central Store with your tenant ID. This ensures that the default path of “%userprofile\OneDrive – Tenant Name” is used. Although the GPO template can also be edited to specify a different sync folder, it doesn’t seem to work with variables at all. In my experience it’s easiest to just accept the default path and then restrict users from changing it.
  • Apply a new folder redirection policy that directs Documents and other folders to the %OneDriveSync% location instead of the home drive on the file server (the policy will move existing files as well).

For this environment I’ve placed the OneDrive GPO as a higher priority than the existing folder redirection GPO. I’ve also scoped the OneDrive GPO only to members of the “OneDrive for Business Users” security group, and denied the “Apply” permission for the previous folder redirection GPO for the “OneDrive for Business Users” group. Note that after removing Authenticated Users from the scope of the new policy, you then need to go to the Delegation tab and delegate the “Read” permission for the GPO, or you may find it does not process at all.

So in effect this all means I can roll out OneDrive to users by adding them to that security group. There is also some end user communication involved in the whole process. You’ll want to make sure your users are expecting the change so there’s no surprises or confusion.

Something to be aware of is that the folder redirection will overwrite any existing data in the destination location that has the same file name and path. If any of your users have already begun using OneDrive and storing files, you should manually deal with those to avoid conflicts. You can find active OneDrive users in the usage reports in the Office 365 admin portal.

Configuring the OneDrive for Business Sync Client

After the GPO has applied, when the user signs in to OneDrive, it will begin syncing that existing data in the local path to the cloud. For environments without any SCCM or other systems in place to initiate a program running in the context of the user, a workaround is to email the user a link to odopen://, which will trigger the OneDrive client to launch. Since you likely want to send them some login instructions and other general adoption advice for OneDrive, you can simply bundle all that up into a single email.

When the user opens OneDrive they’ll be able to walk through the setup process. You should ensure that the instructions you provide are clear about what they should do at each step of the initial configuration wizard.

Monitoring the Deployment

The initial synchronization of files to OneDrive may have a detrimental impact on your network performance. Monitor your network utilization so that you don’t roll out too many users simultaneously.

You can continue to use the OneDrive usage reports in the Office 365 admin portal to track the adoption of OneDrive by your users.

It’s also possible to quickly pull a report of OneDrive usage by using PowerShell.

PS C:\> Connect-SPOService -Url https://exchangeserverpro-admin.sharepoint.com
PS C:\> Connect-MsolService
PS C:\> $urlbase = "https://exchangeserverpro-my.sharepoint.com/personal/"
PS C:\> $users = Get-MsolUser -All | Where {$_.IsLicensed -eq $true}
PS C:\> $odusage = $users | Foreach-Object {Get-SPOSite ($($urlbase)+$($_.UserPrincipalName.Replace(".","_"))).Replace("@","_") | Select Owner,StorageUsageCurrent}
PS C:\> $odusage
Owner                                   StorageUsageCurrent
-----                                   -------------------
tom.jarvis@exchangeserverpro.net                          1
alannah.shaw@exchangeserverpro.net                        1
john.dorey@exchangeserverpro.net                          1
admin@exchangeserverpro.onmicrosoft.com                   1
jane.tulley@exchangeserverpro.net                       278
mike.ryan@exchangeserverpro.net                         130
dave.bedrat@exchangeserverpro.net                         1

Completing the Migration

Once you’re satisfied that user home drives have been migrated to OneDrive for Business, you can do a scan of your file server to confirm that the home drives for users are empty, and then start decommissioning those shares so that the storage can be reclaimed. For any users who have not logged on and completed their migration you can manually assist them, or back up their home drive files elsewhere, or even upload the files to their OneDrive in the cloud yourself so that they’re waiting for initial sync to the client.

The post Migrate Home Drives to OneDrive for Business appeared first on Practical 365.

          

Deploying the Microsoft Teams Desktop Client

$
0
0

Microsoft Teams is now generally available for Office 365 customers, and for those of you who are planning to use it you may be looking for a way to deploy the Teams client to your user’s computers.

The Microsoft Teams desktop client installer is available from Microsoft here. It’s a .exe package, with basic command-line switches for silent install and uninstall. For example, to silently install Microsoft Teams, the following command line can be used:

C:\temp\> Teams_windows_x64.exe -s

To silently uninstall Teams, the following command line can be used:

C:\temp> %userprofile%\AppData\Local\Microsoft\Teams\Update.exe" --uninstall -s

The Teams installer runs in the context of the logged on user and installs to the %userprofile%\AppData\Local\Microsoft\Teams folder, so any deployment script needs to run in the context of the user. A logon script assigned by Group Policy meets that requirement.

Teams is a self-updating application. It will check for, and download, any available updates each time the user runs the program. That makes it simple to maintain (as long as you allow it to self-update), and means that deploying Teams is basically a task of running the installer once, and then not running it again. So with a little scripting logic you can check for the existence of the Teams application in the user’s AppData folder, and run or not run the installer depending on the results.

As a side note, when Teams is uninstalled it leaves the Update.exe file in place. So checking for Update.exe in your script logic will give misleading results. Instead, you can check for the existence of a folder named “.dead”, which is placed in the application folder when Teams is uninstalled. For my deployment script which I’m sharing here, I’ve checked for “.dead”, and if found, will run the Teams installer again.

Preparing to Deploy Microsoft Teams

Before you deploy the Teams client you should verify that Teams in your Office 365 tenant is configured the way you want it. Teams configuration is demonstrated in my Getting Started with Microsoft Teams article.

Although Teams is included with eligible Office 365 plans, it can be enabled and disabled on a per-user basis. If you have had Teams disabled during the preview phase, now is the time to turn it back on. For my demonstration environment I’m using Azure AD group-based license management, and have an Active Directory group that is configured to enable the Teams option for users’ licenses. Helpfully, that also means I have a security group already in place that I can target my Group Policy to.

Download the Microsoft Teams installer and place the file on a network share that can be accessed by your users when the logon script runs. For this demonstration, the installer will be running from the path \\mgmt\installs\MicrosoftTeams.

Using Group Policy to Deploy Microsoft Teams

Download the Install-MicrosoftTeams.ps1 PowerShell script from the TechNet Script Gallery.

Create a Group Policy that assigns a logon script to run the Install-MicrosoftTeams.ps1 PowerShell script, and provide the -SourcePath as a script parameter.

If you are filtering the GPO to a specific security group, remember to also add Authenticated Users to the Delegation tab of the Group Policy and grant them Read (but not Apply) permissions.

At next Group Policy refresh and logon the Teams client will silently install for the user, and place a Microsoft Teams icon on their desktop.

The post Deploying the Microsoft Teams Desktop Client appeared first on Practical 365.

       

Related Stories

 

How Secure is Sending Emails to Microsoft Teams Channels?

$
0
0

One of the features of Microsoft Teams is the ability to send email to Team channels. When a channel receives an email, a new discussion thread is started, and the Team members can discuss the topic within Teams (replies do not go to the original sender of the email, it’s all contained within Teams).

There’s lots of scenarios where emailing a Team channel for discussion around a topic would be useful. Team members could forward an email about a new internal company announcement, or subscribe the team to external alert emails such as security bulletins. Really any “what do you think about this?” type of discussion is made easier by this feature.

However, there are some potential concerns that you should be aware of.

To email a Team channel you must first know the channel’s email address. Within Teams you can get the email address for a channel by opening the menu next to the channel name and choosing Get email address.

The email addresses for Team channels use Microsoft-owned domains. For my region, the domain is @apac.teams.ms.

The first time I tested emailing a channel I did so from an external address, and it worked straight away. That made me wonder what controls or protection can be applied to the channel emails. There are three settings that you can configure for a channel to control the email functionality. The options are accessed by clicking on the advanced settings link when retrieving a channel’s email address.

The default is to allow anyone to send emails to the address. For some organizations this will be a concern. Even though the channel email address is not easily guessable, there are customers who won’t accept security by obscurity. For those customers, choosing Only members of this team, or Only email sent from these domains can be used to reduce the perceived risk of abuse.

Unfortunately, those settings are configured on a per-channel basis. There is no PowerShell administration for Teams (yet?), so no apparent way to check every channel’s settings, or make bulk changes. There’s also no option to change the default behavior to one of the more secure settings. At the tenant-level, the only option is to completely enable or disable the channel email functionality.

That tenant-level setting really needs to be improved to allow administrators to set default email behavior for channels, or to block some of the options entirely (e.g. not allow wide open groups, thereby forcing channel owners to configure specific approved domains if they want external senders to email the channel).

As an aside, when the tenant-level option is set to Off, Teams users are not made aware of it. They are free to continue getting the email address for a channel and trying to send it emails. The sender will receive an NDR, but if the channel owner is trying to send emails from an external source (e.g. a reporting or alerting service) then they might not see those NDRs at all.

While I was playing around with this I started thinking about how the inbound emails to Teams channels are handled. If each team in my tenant has an @apac.teams.ms email address, where does that resolve to?

PS C:\> Resolve-DnsName -Name apac.teams.ms -Type mx
Name               Type   TTL   Section    NameExchange                              Preference
----               ----   ---   -------    ------------                              ----------
apac.teams.ms      MX     3600  Answer     apac-teams-ms.mail.protection.outlook.com 0

It seems that Teams emails go through Exchange Online Protection. I did a quick test by sending emails with and without a malware attachment (using the EICAR test string), and the email with the malware was not delivered. Which is what you would expect.

However that does raise a few questions about the level of protection being provided for Teams. If a customer is paying for EOP Advanced Threat Protection, do they receive that extra protection that ATP provides? It’s hard to say whether ATP Safe Attachments scanning is occurring, but it definitely appears that Safe Links policies are not applied to URLs within the emails. That makes sense, because the email itself never actually routes through your own EOP/EXO service. But in an ideal world the ATP protection you’re paying a premium for would protect you from all emails.

It also raises some potential issues for organizations that have specific security or compliance requirements. If an Office 365 customer requires that all email route through a third party spam filter, an on-premises server via centralized transport, be subject to certain transport rules, or is journaled away to a hosted archiving service, should that also include emails sent to Teams channels? I would say the answer to that question will vary for different customers. Some will consider emails to Teams channels to be different to regular email, while others will view them as the same thing.

Teams has just reached general availability, and the email to channels feature is brand new, so perhaps these capabilities will change over time to accommodate more customer requirements. In the meantime, if you are concerned about the current options available to you, it might be necessary to just completely disable emails to channels until more controls are made available.

The post How Secure is Sending Emails to Microsoft Teams Channels? appeared first on Practical 365.

How Important Are Important Security Updates?

$
0
0

I’ve seen a lot of customer environments that have a Microsoft security patching policy that could be summarized as:

  • Critical patches deployed ASAP
  • Everything else can wait

The idea is that the most critical vulnerabilities get rolled out as fast as quickly as possible (testing is optional, for some customers). But anything in a security bulletin rated Important or lower will get rolled out next time there’s a planned maintenance window, which could be monthly, or quarterly, or never in some cases.

There’s a problem with the idea that only Critical rated vulnerabilities are important. Because often the Important rated vulnerabilities are also… important. As an example, the MS17-015 bulletin contains information about an Exchange Server vulnerability that is rated Important. The description is:

An elevation of privilege vulnerability exists in the way that Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests. To exploit the vulnerability, an attacker who successfully exploited this vulnerability could, perform script/content injection attacks, and attempt to trick the user into disclosing sensitive information.

In today’s security climate that is certainly a risk.

NOTE: For this vulnerability to be exploited, a user must click on a maliciously crafted link from an attacker.

Getting malicious links in front of end users is not actually all that difficult for attackers. OWA usage is quite high in many orgs these days, so a vulnerability like this certainly should be patched as quickly as possible. But it’s easily overlooked due to the Important rating.

Another example last year was MS16-079.

An email filter bypass exists in the way that Microsoft Exchange parses HTML messages that could allow information disclosure. An attacker who successfully exploited the vulnerability could identify, fingerprint, and track a user online if the user views email messages using Outlook Web Access (OWA). An attacker could also combine this vulnerability with another one, such as a Cross-Site Request Forgery (CSRF), to amplify the attack.

To exploit the vulnerability, an attacker could include specially crafted image URLs in OWA messages that could be loaded, without warning or filtering, from the attacker-controlled URL. This callback vector provides an information disclosure tactic used in web beacons and other types of tracking systems. The update corrects the way that Exchange parses HTML messages.

In plain language, the vulnerability was that remote images would be loaded automatically by OWA if they were coded as the background image of a HTML table cell. I was able to reproduce the exploit with minimum effort (it didn’t require any special coding abilities, just some basic HTML). Using it to track a user via a beacon image is nefarious enough. But it’s easy to apply such a technique to phishing and other attacks, by crafting something like a fake PayPal notice that is entirely image-based and would bypass many of the weaker spam filters on the market today. But as an Important vulnerability, it’s easily overlooked.

The takeaway here is to ensure that you’re interpreting security bulletins correctly. Arbitrary rules like “We only deploy Critical patches” or delays on other patches due to their lower rating may be leaving you exposed to what are still serious flaws in the product.

For Exchange Server in particular, the security bulletins that Microsoft issues are also often misunderstood. Customers who look at the MS17-015 bulletin see that Exchange Server 2013 SP1 (which is really CU4), Exchange Server 2013 CU14, and Exchange Server 2016 CU3 are vulnerable. So where does that leave customers who are running other versions of Exchange?

The key is to look at security bulletins in the context of Microsoft support lifecycle. Cumulative Updates are supported for about 6 months, long enough for the next two CUs to be released. Exchange Server 2013 SP1 (CU4) is a special case because it was given a different support lifecycle, but you shouldn’t be running that build in production today. But every other CU in between CU4 and CU14 should be considered vulnerable, even though they aren’t all listed. That’s because Microsoft doesn’t release security advisories for unsupported builds (not even to clarify whether they’re vulnerable or not). The same goes for Exchange Server 2016 CU2 and earlier. Those builds are vulnerable, even though they’re not listed because they’re no longer supported.

The patch cycle for Microsoft products is tough to keep up with. Exchange makes life a little easier thanks to its robust high availability features, allowing us to patch individual servers while maintaining availability of the overall service for our end users. But if it’s still too much effort, there’s always Office 365 to consider. Nobody ever tells me that they miss patching all those servers after they move to the cloud.

The post How Important Are Important Security Updates? appeared first on Practical 365.

Making Sense of Automatic Group Creation in Office 365

$
0
0

Last week a new message appeared in Message Center to let Office 365 customers know about an upcoming change:

To help managers collaborate more effectively with their employees, we will automatically create Office 365 Groups containing the manager’s direct reports. Managers can easily update, delete, or modify the group at any time.

Beginning April 13th , 2017 We will automatically create direct reports groups in Outlook (leveraging the Office 365 Groups Service) for eligible managers.

Looking through the RSS feed from Office 365 roadmap watch, it looks like this feature first appeared on the public roadmap on the same day it was announced in Message Center.

The announcement has been met with confusion and a mostly negative response in discussion threads on the Microsoft Tech Community and Reddit. I’m writing this article for two reasons:

  1. To let you know about this upcoming change in Office 365 that could have an impact on your organization
  2. To clear up some of the questions and answers that are getting buried in the back and forth discussions about the topic

Update: Microsoft has responded to customer feedback and is slowing this roll out, starting with select customers to validate the impact and benefits of the change.

What Will Automatic Group Creation Do?

The roll out of automatic Group creation for Office 365 tenants will result in an auto-created Office 365 Group (that’s big G) for anyone who has between 2 and 20 direct reports.

An Office 365 Group includes a mailbox that acts in a similar manner to a shared mailbox and distribution group combined (members can subscribe to emails sent to the Group, and the mailbox preserves a history of all messages). The Group also has a shared file storage area hosted in SharePoint Online, shared OneNote notebook, and can act as the underlying membership service for Planner and Teams.

The Group will be named “Manager Name’s Direct Reports”, and have an email address of “Manager Alias-dr@yourdomain.com”. The direct reports will be added as members. The manager will be granted ownership of the Group so that they can perform ongoing management of the Group membership.

The benefit to the team is that they can begin to leverage the features of Office 365 Groups for collaboration. As a simple replacement for a traditional Exchange distribution group, the Office 365 Group has the benefit of keeping a history of all communications sent to the Group. However, Groups do not behave the same as Exchange distribution groups, because the sender does not receive a copy of their own message. For some people that is not the desired behavior.

The manager/reports relationships are based on the fields in Active Directory. If those relationships are not defined, no Groups will be created.

So in the above example, a Group named “Jane Tulley’s direct reports” with an email address of “jane.tulley-dr@exchangeserverpro.net” will be created. Jane Tulley will be the Group owner/manager, and the four direct reports will be added as members.

When the Group is created, the Group manager and their direct reports will be emailed automatically to let them know that the new Group is ready for them.

Will Groups be Automatically Created in Tenants That Have Disabled Groups?

No. If your Office 365 tenant has disabled the Groups feature entirely, then no Groups will be automatically created.

How Can We Prepare for Automatic Group Creation?

If you want the Groups to be automatically created, then you should review your manager/reports relationships in Active Directory to make sure they are populated and accurate before the April roll out of this feature.

If you do not want automatically created Groups, or you want to delay the feature from creating any Groups while you clean up your manager/reports relationships, then you can disable automatic Group creation by connecting to Exchange Online using PowerShell, and then running the following command.

PS C:\> Set-OrganizationConfig -DirectReportsGroupAutoCreationEnabled:$false

You can revert that setting to $true later when you’re ready for auto-creation of Groups.

We Already Use Groups for Each of Our Teams, Will New Groups Be Created?

Microsoft says that their algorithm will check whether an Office 365 Group containing the same manager and direct reports already exists. In the example above, if Jane Tulley already has a Group for her team, then a new Group will not be created.

However, if Jane Tulley already has a Group with her direct reports as members, but it also has additional members that fall outside of the manager/reports relationship, then a new Group will be created for “Jane Tulley’s Direct Reports”.

Note that the algorithm checks for Groups with matching membership, not Exchange distribution groups. Even if the team already has a distribution group, they’ll get a new Office 365 Group created as well.

Where this creates duplication, the unneeded Groups can be deleted.

How Can We Remove Automatically Created Groups?

Group owners can delete Groups that they do not want. Microsoft says that if an auto-created Group is deleted, another Group will not be created automatically for that manager in future.

If you want to remove all of the auto-created Groups from your Office 365 tenant, you can identify them all by a special property called “Groupsona:AutoDirectReports”. To find all of the automatically created Groups, connect to Exchange Online using Powershell, and then run the following command.

PS C:\> Get-UnifiedGroup -ResultSize Unlimited | Where-Object {$_.GroupPersonification -eq 'Groupsona:AutoDirectReports'}

Is the Group Membership Automatically Updated?

No. When the Group is created, the membership is populated once and then not automatically updated later when manager/reports relationships change. The Group owner/manager can add and remove Group members to keep the Group membership aligned with their manager/reports relationships, or to add other interested parties to the Group.

What Happens if a Manager or Group Member Changes Teams?

This is where things get a bit messy, so I’ll do my best to accurately communicate what has been shared by Microsoft so far.

If a Group member changes teams (e.g. no longer works for Jane Tulley, and reports to someone else instead), it is up to Jane and the new manager to adjust their Group memberships accordingly.

If a manager changes roles, the ownership of the Group will not be automatically updated. One of two approaches can be used from here:

  • If all of the Group content needs to stay with the new manager, Jane will need to manually grant the new manager of her previous direct reports ownership of the Group, and then the new manager can rename the Group accordingly. However, renaming the Group does not change other values such as the email address and Group URL, which will retain the old manager’s name. The Group ownership should be changed *before* the manager/reports relationships are updated to avoid the possibility of a new Group being auto-created for the new manager.
  • If all of the Group content needs to move with Jane, she will need to remove all of the existing Group members, and then manually add her new direct reports to the existing Group.

If a team is completely disbanded, as often happens, the Group should be decommissioned. There is no archive process for Groups at this time, but you can use Tony Redmond’s guidance here for removing obsolete Groups.

Any content migration between Groups will require manual effort. Some workloads such as Planner and Teams do not have a method to copy or move content though.

Where Can I Learn More?

Microsoft is updating documentation for this feature as more questions and scenarios are put to them by admins and customers.

The post Making Sense of Automatic Group Creation in Office 365 appeared first on Practical 365.

March 2017 Updates Released for Exchange Server

$
0
0

Microsoft has announced the latest round of quarterly updates for all supported versions of Exchange Server.

This is the final update for Exchange Server 2007, which reaches end of life (end of extended support) on April 11th this year.

Changes to .NET Framework Support

Microsoft has previously announced that the support requirements for .NET Framework versions would be changing with the March 2017 releases. The current state of .NET Framework support is documented in the Exchange Supportability Matrix. Microsoft recommends that you install .NET Framework 4.6.2 on Exchange servers that are running the currently supported CU builds (Exchange 2016 CU4/5, and Exchange 2013 CU15/16).

If you’re running earlier Exchange server builds with older .NET Framework versions, use the supportability matrix to determine an upgrade order that will keep you within the bounds of supported versions. For example, if you’re running Exchange 2013 CU14 today, and want to upgrade to CU16, you should upgrade to CU15 first, deploy .NET Framework 4.6.2, then upgrade to CU16.

ADDITIONAL INFORMATION

The post March 2017 Updates Released for Exchange Server appeared first on Practical 365.

        

Help Shape the Fourth Edition of Office 365 for IT Pros

$
0
0

As announced earlier this month, work has begun on the fourth edition of Office 365 for IT Pros. For those of you who are not familiar with the history of this book, here’s a quick summary.

  • The first edition, titled Office 365 for Exchange Professionals, was released in May 2015 during Microsoft’s Ignite conference. At 623 pages long it was the culmination of months of writing (and rewriting, as Office 365 kept changing) by the author team, and focused primarily on transitioning to Office 365 from an Exchange Server admin’s perspective. As a side note, we used a different document layout in that edition. In today’s format, it would come in at about 580 pages.
  • The second edition, titled Office 365 for Exchange Professionals, September 2015 edition, grew to 750 pages, by expanding coverage of existing topics, updating everything that had changed or been made obsolete, and adding coverage of new topics.
  • The current edition, titled Office 365 for IT Pros, 3rd Edition, was released in June 2016. At around 800 pages, plus hundreds of pages more in supplemental material, coverage was expanded even further to address the needs of the wider IT pro community when it comes to Office 365. Hundreds of changes and new features released by Microsoft needed to be included, and ongoing weekly updates have grown the book to more than 900 pages today.

Now it’s time to bring the fourth edition to life. Microsoft has shipped entirely new features and services that deserve inclusion in the book, as well as making changes such as introducing an entirely new Azure Active Directory PowerShell module (necessitating the testing and and replacement of nearly 200 PowerShell samples in the book). We also need to go through the entire book, end to end, and make sure that it remains clear and technically accurate.

Most importantly, we want to make sure that the fourth edition continues to address your needs as an IT pro in a cloud-first world. For that, we’re asking for your help in shaping the content that will be included in the new edition. We’ve created a short survey to collect your thoughts and feedback. It should take only 5-10 minutes to complete.

Click here to answer the survey

The goal is to have the fourth edition available in May, depending on the release of some features on Microsoft’s road map.

We understand that news of a new edition of Office 365 for IT Pros will raise some questions, so here are some answers to the questions we hear the most:

Q: Will the fourth edition be free for people who already own a copy of the book?

A: We provide free updates for the edition of the book that you purchase (here’s the list of updates that have been shipped for the 3rd edition so far). New editions are sold separately, which is necessary to justify the huge investment of time required to update and maintain the book. We will, as always, provide a discounted upgrade to existing Office 365 for IT Pros, 3rd Edition customers for a limited time when the new edition is released.

Q: What happens to the third edition?

A: Updates will continue for the third edition until the fourth edition is released. After that, no further content updates are planned for the 3rd edition, however we may still make updates to fix significant errors (as we did for previous editions after they were superseded).

Q: How long before the fourth edition gets replaced?

A: By the time the fourth edition is released, the third edition will be 11 months old. We expect the fourth edition will remain current for at least 9 months as well. With the number of changes and new features in Office 365 every year, a 9-12 month publishing cycle seems to be the best way to stay current.

Q: What formats will the eBook be available in?

A: We plan to continue with the PDF/EPUB format, and also make available a Kindle format via the Amazon store. If you have other preferences, please take the survey and let us know. If there is enough demand for another eBook format we will look into it.

Q: Will there be a print edition?

A: We don’t plan to provide a print edition. The rate of change in the book would render any print book almost immediately out of date.

If you have any other questions, please feel free to leave a comment below.

The post Help Shape the Fourth Edition of Office 365 for IT Pros appeared first on Practical 365.

Restricting OneDrive Sync to Domain Joined PCs

$
0
0

For some organizations there is a concern when deploying OneDrive for Business that users will access corporate data from their personal computers. If the personal computers are not well secured, such as having encrypted drives and good antivirus software, or if the personal computers are shared with unauthorized people, then the corporate data could be exposed.

To address those concerns it’s possible to restrict OneDrive so that it only synchronizes files to domain-joined computers. The general idea is that a domain-joined computer that is within the control of corporate IT will be more secure than the average personal computer that staff own. OneDrive sync restrictions can be configured using the OneDrive admin portal, or the SharePoint Online PowerShell module.

Before you can restrict OneDrive to domain joined computers, you first need to know the GUID of the Active Directory domains that will be allowed to sync. To retrieve the domain GUID, run the following command from a computer or server that has the Active Directory PowerShell module available.

[PS] C:\>(Get-ADForest).domains | foreach {Get-ADDomain $_ | Select Name,ObjectGuid}
Name                                  ObjectGuid
----                                  ----------
exchangeserverpro                     4764a27a-1465-445b-8697-ce1086805439

Next, connect to SharePoint Online and view the current sync restrictions. By default there are no sync restrictions configured.

PS C:\> Get-SPOTenantSyncClientRestriction
TenantRestrictionEnabled   : False
AllowedDomainList          : {}
BlockMacSync               : False
ExcludedFileExtensions     : {}
OptOutOfGrooveBlock        : False
OptOutOfGrooveSoftBlock    : False
DisableReportProblemDialog : False

To enable sync restrictions and add the domain GUID to the allow domain list, run the following command.

PS C:\> Set-SPOTenantSyncClientRestriction -Enable -DomainGuids "4764a27a-1465-445b-8697-ce1086805439"
TenantRestrictionEnabled   : True
AllowedDomainList          : {4764a27a-1465-445b-8697-ce1086805439}
BlockMacSync               : False
ExcludedFileExtensions     : {}
OptOutOfGrooveBlock        : False
OptOutOfGrooveSoftBlock    : False
DisableReportProblemDialog : False

The sync policy change takes around an hour before it is effective. After the new configuration is in place, a user trying to add a OneDrive account to a computer that is not domain joined will receive an error message after they sign in and choose a location to sync to.

Sorry, OneDrive can’t add your folder at this time. Please contact support.

Any existing sync relationships for computers that are not domain joined will begin showing a “sync blocked” message in the system tray, and when OneDrive is opened from the system tray will display a more detailed error message.

Your IT Department requires that you use a computer that is joined to an approved domain to sync this folder. For assistance, contact your IT Department.

When you restrict OneDrive sync to specific domains you should be aware of the following caveats:

  • Computers that already have files synced to their local hard drive will not have the files removed.
  • The domain join requirement does not apply to Macs, however you can enable or disable Mac sync as a separate restriction in the OneDrive admin portal (or via PowerShell).
  • The policy will not restrict sync to mobile devices. For that you should use a device access policy, or use Intune.

The post Restricting OneDrive Sync to Domain Joined PCs appeared first on Practical 365.

       

Related Stories

 

The Debate Over Enabling New Office 365 Features by Default

$
0
0

The recently announced Office 365 feature that will automatically create Groups based on manager/reports relationships in Active Directory reignited the debate about new features being enabled by default. The discussion in the Microsoft Tech Community was robust, and outlined many flaws in the proposed feature. But regardless of the merits of that particular feature, the discussion brought up the point that defaulting new features to “enabled” (or opt-out) is the wrong approach for many customers.

The issue is a big enough concern that a Uservoice item has been opened to collect votes from the community.

Tenant administrators should have the ability to specify whether or not new features such as Teams, Sway, etc. are enabled by default within their tenants. Just like there’s the ability to set a tenant to receive First Release, Admins should be able to specify how changes are introduced to their environment. It’s great that there are PowerShell commands to turn features on/off but it would be much easier to either set these new features to be off by default, or enable Admins to enable when organizations are ready to absorb those changes. Functionality like Teams is absolutely fantastic, but without the right change management planning it becomes confusing for users. For Tenant Admins that either ignore announcements of new features, or are unavailable to turn them off when they become available – this is an appropriate solution to enable organizations to effectively manage how they are consuming Office 365.

As I wrote in my article on managing change in Office 365, changes can create a burden for support staff, especially front line staff who will be hit with a wave of new questions when something changes. For organizations that have strict controls around change management, being able to control the deployment of new features is essential. I’ve heard from customers who use the ITIL framework, and they say that Office 365 has increased their costs because every single change needs to be managed in that framework. For them, being able to disable new features like Teams, or Focused Inbox, or Groups is essential. And while most new features can be disabled on a per-tenant or per-user basis so that the roll out can be managed through their change control processes, others such as the change in email sending behavior for Groups have no opt-out mechanism and are basically enforced on all customers. The ITIL organization has no choice but to adapt to those enforced changes.

The burden on IT departments is one side of the issue. There is also the impact that adding more complexity and variance to Office 365 will create. Taking the example of the email sending behavior for Groups, if that was presented as an option, that means more code is required to deal with Groups that have the option set one way or the other. The more code and complexity involved, the more development, testing and support costs are incurred, and the more risks there are of bugs surfacing. A service as large and complex as Office 365 is only possible when things are consistent and predictable across the entire environment.

We also need to consider whether innovation in Office 365 would slow down if adoption rates plummeted due to features being disabled by default. It should come as no surprise that one of the reasons new features are enabled by default is so that they are adopted faster by customers. For customers with minimal IT support, being able to use Teams, or StaffHub, or Bookings without needing an IT person to switch it on for you first is a positive thing. If features were always opt-in, those customers would simply miss out. And it’s entirely feasible that some IT consultants doing one-off projects to migrate customers to Office 365 would flip the switch to disable new features, with the justification that it’s for the good of the customer, and then walk away. I have no special knowledge of Microsoft’s internal decision making process around development of new features, but I assume that it would be difficult to justify investment in features if adoption is going to be limited.

This is an issue with no clear answer. If the option to disable all new features by default were made available, where do you draw the line on what constitutes a feature vs a change? If you call Teams a feature, and the Groups sending behavior a change, customers will still be caught out by unexpected changes if they’re not paying attention. That brings us back to what is perhaps the core of the issue – tenant admins who “either ignore announcements of new features, or are unavailable to turn them off when they become available.” Should we be advocating a change that caters to admins who are ignoring announcements? Or should the onus be on them to get with the program and deal with the reality of cloud services?

Clearly some folks are unhappy with the current situation, hence the Uservoice suggestion above. What do you think? Should there be an option to opt-out of all new features by default? Would you use that option for your own Office 365 deployments?

The post The Debate Over Enabling New Office 365 Features by Default appeared first on Practical 365.


Restoring Deleted Office 365 Groups

$
0
0

Microsoft is rolling out the long-awaited capability to restore a deleted Office 365 Group. When Groups are deleted they are now retained for 30 days by default in a “soft deleted” state, and administrators can restore the group within that period if desired. All of Group data including associated applications such as Teams and Planner is included in this restore capability, but as I discovered in my testing, Teams still has a few issues that need working out.

To give this new capability a test I created three new Groups using Outlook, Teams, and Planner (actually four, because of an error in Planner). The new Groups appeared in my Office 365 Groups report output as new Groups.

Next, I deleted each Group through the same application that was used to create it. Another run of the report script shows the Groups as deleted.

To view a list of soft deleted Groups we can use the Get-AzureADMSDeletedGroup cmdlet in PowerShell. This cmdlet is available today in the AzureADPreview PowerShell module, and we can expect it to be added to the AzureAD module in the near future.

PS C:\> Get-AzureADMSDeletedGroup
Id                                      DisplayName                             Description
--                                      -----------                             -----------
7c3d972b-0e25-49ab-baaa-4dcb3a0c39dc    GRP-CreatedViaPlanner                   GRP-CreatedViaPlanner
d1ddaca7-22e6-4267-9795-d208592f2ef1    GRP-CreatedViaOutlook                   GRP-CreatedViaOutlook
fcb8e99e-ca17-441f-8ba0-66bb8c435b12    GRP-CreatedViaTeams                     GRP-CreatedViaTeams

Once you know the Id of the Group you want to restore, the Restore-AzureADMSDeletedDirectoryObject cmdlet is used to restore it.

PS C:\> Restore-AzureADMSDeletedDirectoryObject -Id d1ddaca7-22e6-4267-9795-d208592f2ef1
Id                                      DisplayName                             Description
--                                      -----------                             -----------
d1ddaca7-22e6-4267-9795-d208592f2ef1    GRP-CreatedViaOutlook                   GRP-CreatedViaOutlook

Microsoft warns that this process should take only a few minutes, but can take up to 24 hours in some cases. When the restore is complete, the Group will be available using Get-AzureADMSGroup.

PS C:\> Get-AzureADMSGroup -Id d1ddaca7-22e6-4267-9795-d208592f2ef1
Id                                      DisplayName                             Description
--                                      -----------                             -----------
d1ddaca7-22e6-4267-9795-d208592f2ef1    GRP-CreatedViaOutlook                   GRP-CreatedViaOutlook

The restored Group now appears as a new Group in my report.

One thing I noticed in my testing is that the Group members are restored along with the Group, except for the Group admin. In my case, all three Groups that I deleted using Jane Tulley’s account, did not restore her membership of those Groups. For the Outlook and Planner-created Groups, Jane was able to simply rejoin them, because they were public Groups (which is the default).

For the Teams-created Group, the Group type defaulted to private. When Jane attempts to rejoin, an approval request is sent to the Group admin, which is herself in this case. Clicking the link to “go to Group members” and add herself didn’t work.

The dialog for adding members shows that she is the admin, but won’t let her add herself as a member.

If she uses the Approve button in the email instead, then her membership is approved successfully.

However, although the rejoined Group appears in Jane’s Outlook, it does not appear in her Teams desktop client or web client. As a private Group, the Team also can’t be seen in the list of available public teams to join. However, after changing the Group from private to public, and then waiting a short time, the Team appeared as a public Team for other users who were not already members, but not for Jane Tulley who is a member and admin for the Group. Presumably the Team doesn’t appear in the list of Teams to join for Jane because she’s already a member. Eventually, a few hours later, the Team appeared in Jane’s Teams client.

This seems to be a wider issue with Teams when Groups are restored. I ran the test again, this time with a public Team that had multiple members. Again, the restored Team did not appear in any Teams desktop or web clients until the member was removed from the Group, then they could see the Team in the list. However, attempting to join a restored Team fails.

I ran through a variety of test scenarios, creating and deleting Teams. As a side note, here’s a simple one-liner for restoring all soft deleted Groups.

PS C:\> Get-AzureADMSDeletedGroup | foreach {Restore-AzureADMSDeletedDirectoryObject -Id $_.Id}

In some cases, public Teams that had been restored appeared almost immediately for other users to join, however could be joined by new members. The same error shown above was occurring.

 

After a few hours of testing, eventually all of the restored Teams were able to be accessed again, and the public Teams could be joined by new members. This may have all been just a symptom of the delays during restoration that Microsoft indicated could take up to 24 hours.

It’s good to see recovery of Office 365 Groups is now available, but it looks like there’s still a few wrinkles to iron out for Teams to smooth out the user experience.

The post Restoring Deleted Office 365 Groups appeared first on Practical 365.

What’s New in Office 365 for March 2017

$
0
0

March has been a huge month for Office 365 Groups. We kicked things off with a change to the email sending behavior for Groups, which immediately confused people who were used to seeing their own Group emails arrive in their own inbox.

After that relatively minor change, a robust debate erupted around the surprise announcement that Microsoft will be automatically creating Office 365 Groups based on manager/reports relationships in Active Directory. The change appeared on the Office 365 road map with an immediate status of “Rolling out”, but was met by almost unanimous disapproval by the customers and IT pros who jumped into the conversation. Microsoft has since backed down and will roll the change out to a select group of customers first to give it a proper smoke test. They haven’t withdrawn the change entirely though, so you should still plan accordingly.

Microsoft’s newest Groups-based service, Teams, became generally available for business and enterprise customers, and then a few days later also became available for education customers. Teams improved quite a lot between preview and general availability, and is an immediately useful collaboration tool with a lot of integration options for third party services. Key features such as external guest access are also coming to Teams over the next few months, so this is definitely an application to pay close attention to and get it out to your users as soon as possible.

Rounding things out for Groups developments in March, we finally have the ability to restore deleted Groups. Deleted Groups now sit in a soft-delete state for up to 30 days, during which time an administrator can restore the Group along with all associated application data such as Teams, Planner, and SharePoint. The inability to recover deleted Groups has been big reason that many customers have held off on adopting them. So this change should see an upswing in Groups usage among customers. This is the right way to increase Groups adoption, by shipping features that customers want. Not by automatically creating them 😉

As you start to use Groups in your organization, make sure you run the Office 365 Groups report script to keep an eye on what is being created, changed, or deleted.

In Exchange Online, the Focused Inbox roll out continues, and has actually appeared in one of my tenants now. An important note for Focused Inbox is that it is only available in supported versions of Outlook. Today that includes Outlook for iOS and Android, Outlook for Mac, Outlook on the web, and Outlook 2016 (but only the Office 365 subscription version, not the standalone MSI version). Focused Inbox will not be available in any other versions of Outlook.

Exchange Online has also rolled out a change that allows the sent items behavior to be configured for user mailboxes, so that when delegates use send as or send on behalf the sent message is copied to the owner’s mailbox. Previously this functionality was only configurable on shared mailboxes, but now user mailboxes can be configured as well.

In other news this month:

  • Skype for Business Online voicemail transcription is rolling out on March 31st to all customers. Users will receive a transcription of their voicemail messages in the email body.
  • Flow integration with SharePoint Online lists and libraries has been added, including the ability to launch Flows on demand from lists and libraries. This feature is rolling out between now and the end of April.
  • Yammer Analytics are moving to the Office 365 admin portal, starting with overview and access information.

As a heads up for next month, DirSync and AADSync support ends on April 13th, 2017. They won’t immediately stop working, but you won’t be able to get support from Microsoft if you have directory synchronization problems. Time to upgrade to Azure AD Connect.

The post What’s New in Office 365 for March 2017 appeared first on Practical 365.

DirSync and AADSync Support is Ending, Time to Upgrade to Azure AD Connect

$
0
0

Microsoft has provided a variety of directory synchronization tools to customers over the years, most recently Azure AD Connect (AADConnect). Previously, customers could choose from DirSync or Azure AD Sync (AADSync) as well.

Development of DirSync and AADSync ended long ago, with the announcement in April 2016 that both tools were now deprecated. One year of further support was provided, and that ends on April 13th, 2017. Although the tools won’t stop working (at least not yet, but it will happen one day), you will no longer be able to get support from Microsoft if you are having directory synchronization issues.

As a side note, customers using AADConnect who have not enabled automatic upgrade, and have not been manually upgrading, will also become unsupported if their AADConnect build number is earlier than 1.1.

For more information about your upgrade options, refer to these articles that Microsoft has published:

The post DirSync and AADSync Support is Ending, Time to Upgrade to Azure AD Connect appeared first on Practical 365.

        

New Pluralsight Course – Managing Exchange Mailboxes and Distribution Groups in PowerShell

$
0
0

I’m pleased to announce that my latest Pluralsight course, Managing Exchange Mailboxes and Distribution Groups in PowerShell, has emerged from the production cycle and is now available to watch.

I enjoyed creating this course because it brings together the two technologies that have had the most impact on my career to date – Exchange Server, and PowerShell. In some respects, Exchange admins had a head start on the rest of the IT pro community because of Exchange Server 2007, a product that coincidentally is reaching end of life in just a few days time. As I explained in my blog post, Why PowerShell, it was working with Exchange that pushed me into learning how to use PowerShell.

I was supporting far more users and servers than I ever had before, and I realized there was no way I could keep up without the help of scripting and automation. And that meant a lot of time writing PowerShell. Automation became critical to our team’s ability to perform our duties, as our head count shrank but our responsibilities grew. Doing “more with less” was the reality we were dealing with.

Not much has changed today. PowerShell is a critical skill for IT pros who work with Microsoft technologies. We see it in job ads, and there are strong communities built around sharing of PowerShell scripts and code. And quite a lot of the most popular blog posts here either relate to using PowerShell for an administration task, or have a PowerShell solution for a problem.

Which brings us to my new course with Pluralsight. When I created this course I had two types of people in mind:

  • An IT pro who has Exchange admin responsibilities, but is inexperienced with PowerShell. Exchange Server is a great way to learn about PowerShell, and this course is suitable for beginners (I make a few recommendations in the first module for some introductory content to go watch first, if you need it).
  • An IT pro comfortable with PowerShell, but new to Exchange administration. If that is you, then you can either watch the course from start to finish, or you can dip into specific lessons to learn the tasks you need.

In either case, if you also need a test lab environment to learn in, you can build one on two VMs following the lab setup guide that’s included with the course, or just grab a free copy of my Exchange Server 2016 Quick Start Guide.

The complete list of modules, which total just over 3 hours of content, are:

  • Module 1 – Course introduction
  • Module 2 – Managing user mailboxes
  • Module 3 – Managing shared mailboxes and delegate scenarios
  • Module 4 – Managing resource mailboxes
  • Module 5 – Managing archive mailboxes
  • Module 6 – Other mailbox management scenarios
  • Module 7 – Managing distribution groups
  • Module 8 – Reporting and automation

If you’re a Pluralsight subscriber you can find the course here. If you’re not already a Pluralsight subscriber, you can sign up for a free trial to watch this course and others for 30 days.

The post New Pluralsight Course – Managing Exchange Mailboxes and Distribution Groups in PowerShell appeared first on Practical 365.

First Steps: Configure Office 365 First Release Settings

$
0
0

Signing up to a cloud service like Office 365 means you’re on board for whatever changes the vendor deploys to customers. That is one benefit of cloud services, but some customers see it as a risk and prefer to at least make sure they are not the first customers to receive new features. Other customers prefer to be slower to receive new features to allow time for following appropriate change management processes and preparing end user communication. Microsoft accommodates these needs with the concept of First Release for Office 365 tenants.

When a new feature or change is developed for Office 365, Microsoft first releases it to their own internal development team, and then roll it out to their corporate user base. For some developments there may also be a preview program that customers or third party vendors can take part in to see the early versions of the feature and provide testing feedback.

When the time comes to release a feature to the general customer base, it first goes to tenants who have opted in for First Release. The First Release customers will receive the new feature anywhere from a few weeks to a few months ahead of the general customer base.

Gaining access to new features first is appealing to some customers, such as those who provide consulting or training to other customers. In return, First Release customers must accept the risk (albeit a low risk) that some bugs or problems might appear in the feature as it is rolling out. You should not be taking part in First Release if you’re not willing to accept that risk.

To view your First Release configuration, log in to the Office 365 admin portal and navigate to Settings, and then Organization profile. Then, click on the Edit button next to Release preferences.

The options you can choose from are:

  • Standard release – your tenant receives updates as they roll out to the general Office 365 customer base. You might still receive updates before or after other tenants because features roll out in stages instead of to all customers at once.
  • First release – your tenant will be among the first to receive updates.
  • First release for selected users – individual users you select in your tenant will receive updates before the rest of your organization’s users.

By default, an Office 365 tenant is configured for Standard release.

You can check the release configuration for a tenant by connecting to Exchange Online and running the Get-OrganizationConfig cmdlet.

PS C:\> Get-OrganizationConfig | Select ReleaseTrack
ReleaseTrack
------------
StagedRollout

Note that in the example above, StagedRollout shows that “First release for selected users” is configured. If you’ve configured your tenant for staged rollout, you can check the list of individual users who are enabled for First Release by connecting to Office 365/Azure AD and running Get-MsolUser.

PS C:\> Get-MsolUser | Where {$_.ReleaseTrack}
UserPrincipalName                    DisplayName    isLicensed
-----------------                    -----------    ----------
adam.wally@exchangeserverpro.net     Adam Wally     False
aaron.gardiner@exchangeserverpro.net Aaron Gardiner True
john.dorey@exchangeserverpro.net     John Dorey     True
jane.tulley@exchangeserverpro.net    Jane Tulley    True
Alan.Reid@exchangeserverpro.net      Alan Reid      False
dave.bedrat@exchangeserverpro.net    Dave Bedrat    True

For a quick count, run the following command instead.

PS C:\> Get-MsolUser | Group-Object -Property:ReleaseTrack | Select Name,Count | ft -auto
Name             Count
----             -----
                   431
StagedRolloutOne     6

You can’t use PowerShell to configure First Release for your tenant or for individual users yet. This capability will hopefully be added to a future release of the Azure AD PowerShell module.

If your organization is not willing to have full or partial First Release for your production tenant, but still want early access to features for testing and training purposes, then you should create an Office 365 test tenant and configure it for First Release.

The post First Steps: Configure Office 365 First Release Settings appeared first on Practical 365.

Viewing all 543 articles
Browse latest View live


Latest Images