A customer recently asked me how can we delete chat history in Microsoft Teams and the answer was really simple. Provided the tenant has the correct Office365 licensing. The solution was to create a retention policy and delete all chat history older than 1 day.
How to delete Teams Chats and Meeting Chat Moderation Settings
Free busy not working in an Exchange 2016 CU17 Hybrid environment.
When a customer forgets to tell you that they previously configured Exchange Hybrid using the Modern hybrid agent, The modern hybrid agent leaves behind some configuration settings that prevent free-busy working from EOL to EOP.
I always use the classic hybrid wizard for organisations that require long term rich co-existence.
The frustrating this with this issue is that the Exchange Remote Connectivity analyzer tests WORK, which would lead you to believe everything is ok and configured correctly. But when you attempt to query availability requests for a user or resource from OWA or Outlook , the look up fails.
What does the Hybrid Agent leave behind in Exchange Online?
Two values are populated that will prevent free \ busy from EOL to EOP working.
When you query these values , You may see a value like https://a75aa21a-2f8d-4b2e-85fe-1234.resource.mailboxmigration.his.msappproxy.net/EWS/E
To resolve the issue run the following commands
set-intraorgconnector -TargetSharingEpr $null
set-OrganizationRelationship “Name of Org Relationship” -TargetSharingEpr $null
One of the pre-requisites for Teams (online) integration with Exchange on-premise calendars is oauth authentication.
Sometimes solution providers just install a single or multiple Exchange 2016 servers to ensure the oauth pre-requisite is delivered. However if the project scenario requires Exchange on-premise mailboxes to be migrated as quickly as possible to Exchange Online then it may seem overkill to implement Exchange 2016 servers during this transition period.
Exchange 2013 CU24 and above does not complete the oauth authentication part of the Hybrid wizard, however Microsoft do have an article on how to configure OAUTH for Exchange 2013.
This solution works perfectly and allows an organization to transition from Exchange 2013 to Exchange Online without the requirement for Exchange 2016 servers and enables Teams to interact with Exchange 2013 on-premise calendars.
In my previous post on how to secure Office 365 Roles and this post is about how to secure Azure Resources.
Office365 and Azure Active Directory have a number of roles that are familiar like global administrator , compliance administrator etc. One of the most common use cases for Azure PIM it to request just in time access to the global administrator role
As organisations extend their networks into Azure , Azure subscription’s costs can sometimes spiral out of control. And this post will demonstrate the technical steps required to lock down the ‘virtual machine contributor’ role with Azure Privileged Identity Management, so that it requires finance department or senior it approval to create virtual machines in Azure, and the process around making technical admin staff eligible for the ‘virtual machine contributor role’
An example of how Azure costs could spiral , An Azure Admin , provisions the most expensive high performance virtual machine available in Azure, makes the VM geo-redundant, adds in a few ultra disks and a few Terra Bytes of Azure Blob Strage.
If there are multiple Azure subscriptions, The eligible users and app-rovers will need to be configured per subscription.In the image below we want to manage Azure Resources.
We click on Azure Resources and then click on settings.
Add the app-rovers for the role and ensure the app-rovers have mailboxes so that they receive the email notification
Next step is to add eligible users for the virtual machine contributor role.
Now any admin that needs to provision a virtual machine in Azure has to follow a workflow and can only do so when senior IT resources or finance department users have approved the provision of the virtual machine
When securing cloud services like Office365 with Azure MFA , End User education and adoption is absolutely critical. Not all organisations’ can afford Azure Active Directory Premium Edition Plan 2 or M365 E5 subscriptions.
Azure Identity Protection provides dynamic protection against the following scenarios.
Anonymous IP address
Unfamiliar sign-in properties
Malware linked IP address
Azure AD threat intelligence
In the event of credentials being compromised the bad actor must get past the next level of authentication which will normally be the Microsoft Authenticator App or a text message.
It is critical to educate end users : DO NOT APPROVE random authentication requests. If an end user is on leave and not attempting to access their cloud resources there should be no reason to approve multi factor authentication challenges.
Azure Active Directory has excellent security with conditional access being one of the most widely used tool to protect Azure Active Active Directory.
The sceen shot below shows the default settings for an Azure AD Premium Plan 2 tenant.
The information tab on the user consent to apps accessing company data on their behalf reads like this:
If this option is set to yes, then users may consent to allow applications which are not published by Microsoft to access your organization’s data, if the user also has access to the data. This also means that the users will see these apps on their Access Panels.
If this option is set to no, then admins must consent to these applications before users may use them.
So in the scenario where a phishing email slipped through the cracks and an end user grants access to a non Microsoft application to their organizations’s data. We do not want that to happen!!!!
The correct setting is listed below
Application administrators should be granted the application administrator role in Azure Active Directory , Then the next time an and user wants to add an application, the application administrator will receive an email and can approve from his\her Outlook client.
The next time an end user or IT staff member wants to add an application to Azure AD, Do not just simply grant the global administrator role.
User Azure Privileged Identity Management and Application Administrator Roles!
I recently encountered a unique scenario when using Quest Migration Manager for Active Directory. I was in the process of migrating 3 AD Forests into a new AD Forest. I had already migrated 1200 users into the new AD Forest and at the time of migration the UPN’s were contoso.com.
My customer then decided to change all UPN’s and primary smtp domains to @fabrikam.com in the middle of the project. This caused a big problem when computer accounts were being migrated. After the computer account had completed migration to the new domain, the user’s UPN was @contoso.com. Which meant the user had to change their UPN to login instead of just simply entering their existing AD password that they were previously using.
So how do we resolve this issue.Right click on the properties of the domain pair as per image below
Next change target domain to contoso.com or a fqdn of a domain controller in contoso.com
Next modify the security settings and set the domain suffix to fabrikam.com
Finally stop and start the synchronization task.
Once this has been completed, when computer accounts are migrated the correct UPN will be populated and users simply need to enter their existing AD password.
In a previous post on how to dynamically assign Intune licenses using Azure dynamic user security groups.
When an organisation has configured global labels like the default labels displayed below. An organisation can choose to apply a policy to all users or all Azure Information Protection Plan 1 licensed users or all Azure Information Protection Plan 2 licensed users.
Azure Information Protection Plan 1 Azure Security Group
Create an Azure Active Directory Dynamic User Security Group , Edit the query and enter the query below for Azure Information Protection Plan 1 licensed users.
If the during the creation of the group , it fails with an error , delete the “” that encapsulates the “guid” and “enabled” within the query and use your keyboard to replace the “” if you are copying them from this blog post.
So this solution enables administrators to apply policies to all AIP plan 1 and plan 2 licensed users and because it is dynamic , it will catch all new employees in the organisation.
I always recommend the Outlook mobile client to my customers as this application can be included in an Intune app configuration & protection policy to protect and encrypt corporate data.
One of the features that the native IOS & Android mail client provides to end users is the illusion that the global address list of the organisation that they work for is in their native contacts. So when an end user searches for users in their company they expect to get the contact information instantly. Users must use Outlook Mobile.
End users mostly complain about loosing this feature but the argument is security comes first and Outlook Mobile is more secure! It is very difficult to find the balance between security and productivity.