Flamingkeys.com Website Review

About – FlamingKeys – Active Directory, Office 365, PowerShell

Active Directory, Office 365, PowerShell

FlamingKeys

Find Me

Copy Files to Office 365 Groups with PowerShell – FlamingKeys – Active Directory, Office 365, PowerShell

Office 365 Groups are a great upgrade on the traditional SharePoint Site/Shared Mailbox/Shared OneDrive folder/whatever you were previously using to share stuff. They’re a perfect candidate for migrating a department’s “network drive” (as the users would call it) to. Perhaps your HR department have S:Human Resources, and Finance have S:Finance. Or worse, perhaps HR have J: (or whatever the Service Desk person mapped it to) and Finance have X: (or some other drive). Groups are a great way of centralising file storage and making files accessible to approved users from wherever they happen to be.

FlamingKeys

Getting Started

Office 365 Groups - Best Practices for Admins – FlamingKeys – Active Directory, Office 365, PowerShell

Office 365 Groups are here! They have been for a while. They keep changing, nobody really knows what they do, and they kind of are just there . Sound familiar? Lots of Office 365 deployments leave the Groups configuration at the default…and that’s kind of what Microsoft seems to want. Everything Just Works and your users are enabled to do whatever they want.I think we can do it better, however. So in no particular order, here’s my completely made up list of Best Practices for deploying Office 365 Groups. These are recommendations I’ve come up with after many Office 365 deployments involving Groups.If you want to apply the settings I encourage below using Windows PowerShell, you’ll likely need to grab a module, and a bit of configuration in advance. See Configuring Windows PowerShell at the bottom of this post.Don’t turn off user creation of GroupsI know, I know, you’re an AD person from the 2000s when the mantra was “users will break it if you let them touch it”. Let’s try something new: empower your users to do things within their own siloed areas they can’t reach out of. If they break something in there, they’re only breaking it for themselves and their colleagues, and probably only temporarily.Check if users are allowed to create GroupsEnable users to create GroupsGroup Naming ConventionsNaming PrefixesNaming prefixes allow for user created Groups to have distinguishing names to allow them to be identified as user-created. A popular choice is to prefix all Groups created by users with “GRP”. This can be done as follows:Banned words and profanity filteringEmpowering users is all well and good, but there’s always the cheeky one or two who will think it’s a great idea to put a profanity or other inappropriate word into a Group name. We can work to prevent this with banned words/profanity filtering.Group Email Address ConventionsGroups can live in any domain of your Office 365 tenant. By default, they’ll use the default domain in your tenant. If you’re running some kind of directory synchronization, this is probably your .onmicrosoft.com domain. Not exactly pretty, and entirely non-portable. I tend to find organizations are fond of the following two options: @contoso.com. Create an Email Address Policy for your Groups to place them under the same domain as your regular users. This allows for alignment and a consistent appearance irrespective of recipient type @groups.contoso.com. Create an Email Address Policy for your Groups to place them under their own domain. This requires some additional configuration in Office 365 to validate the domain, but it allows groups to exist separately under their own discrete namespaceIrrespective of which of the above you choose, do not leave it @.onmicrosoft.com. The onmicrosoft.com domain belongs to Microsoft. If your organization chooses to leave Office 365 for another provider, any @.onmicrosoft.com email addresses cannot be moved.New-EmailAddressPolicy -Name Groups -IncludeUnifiedGroupRecipients -EnabledEmailAddressTemplates “SMTP:@groups.contoso.com” -Priority 1Group ExpiryIf you have Azure AD Premium P1 licensing or better, you can use Group expiry. This is a great way of encouraging your users to self-manage Groups. Group Owners receive an email when their Group is due to expire prompting them to renew it. If they don’t renew it, the Group goes away. Configure Group ExpiryConfiguring Windows PowerShellTo run the commands in this post, you’ll need the following Windows PowerShell modules installed: AzureADPreview (The new module for managing Office 365 via the Graph. Exposes *-AzureAD* cmdlets). Note that you must be running the Preview version of this module to access all the right cmdlets. Several of these cmdlets collide with cmdlets exposed by the AzureAD module that you probably also have installed, so you should prefix any *-AzureAD* commands in this post with AzureADPreview. So Get-AzureADUser would be issued as AzureADPreviewGet-AzureADUserTo install the modules above, run Windows PowerShell as an administrator and issue the following commands:Once you’ve installed the module, connect to Azure AD. We’ll make sure you already have a Unified Groups configuration setting to modify. If not, we’ll create one. Exchange Online PowerShell requires installation of a ClickOnce application from within Office 365. Instructions are on TechNetFurther Reading Azure Active Directory cmdlets for configuring group settings Office 365 Groups naming policy

FlamingKeys

Don’t turn off user creation of Groups

Check if users are allowed to create Groups

Localized(/localised) OneDrive For All – FlamingKeys – Active Directory, Office 365, PowerShell

Office Apps in the browser (Excel Online/Word Online/PowerPoint Online/etc.) all utilise a user’s OneDrive Site Collection to gather their settings and configuration. If your users are somewhere other than the U.S., they probably use a sensible date format like dd/mm/yyyy or dd/mm/yy. None of this backwards mm/dd/yyyy stuff.Users can change their own OneDrive locale in Site Collection Settings…but try telling that to 20,000 users. Along comes @brendankarl. This article provides a good start to getting this done, but it’s still a bit manual for my liking. Here’s my adaptation of Brendan’s script.Firstly, you’ll need an account that’s a SharePoint Administrator or more. Chances are you’re a Global Admins member, so we’ll roll under that umption. Additionally, you’ll want the Microsoft.SharePointOnline.CSOM NuGet package, or grab the redistributable version.Retrieve the scripts from the GitHub repository chrisbrownie/LocalizeOneDriveForBusiness.Let’s ume we’re working on the Azure AD directory contoso.onmicrosoft.com.There’s two scripts to run. The first will make you an Admin level user on every single OneDrive for Business in the tenant. Sounds , and it kind of is. Make sure this isn’t going to get you fired.GrantPermissionsForOneDriveOwnership.ps1 ` -TenantServiceDomain contoso ` -Credentials (Get-Credential [email protected])Great, now we own everyone’s OneDrive for Business Sites, let’s set the new locale ID. Grab the ID number from here. We’ll set our Contoso users to utilise the English (Australia) locale, otherwise known as 3081.LocalizeOneDriveForBusiness.ps1 ` -NewLocaleId 1234 ` -TenantServiceDomain contoso ` -Credentials (Get-Credential)Easy as that! If you have 20,000 users, this will take a very long time.

FlamingKeys

Delete All Content from an Exchange Online Mailbox – FlamingKeys – Active Directory, Office 365, PowerShell

Exchange has traditionally offered several methods by which to delete content from a mailbox as an administrator. Search-Mailbox is good, but runs synchronously and requires that PowerShell be running, connected to Exchange Online for the duration. Compliance Searches can work too, but in my experience,they’re slow and unreliable.The most reliable method I’ve found so far is to create a retention policy witha one-day deletion tag, then force the Managed Folder istant to process themailbox. This looks like the following:Create a retention tagThis creates a tag called 1 Day Delete which deletes items more than 1 day oldCreate a retention policy and ign the 1 Day Delete TagThis creates a policy called Mailbox Purge Policy and igns the 1 Day Delete tag to it. ign the retention policy to the mailboxes to be purgedLet’s ign the Mailbox Purge Policy policy to the mailboxes to be cleared.In this case, it’s AdeleV and KimA.After the policy is applied, the Managed Folder istant should be triggeredto force an immediate application of the policy. Beware that AD replicationwithin Office 365 may mean that the Retention Policy takes around half an hourto apply, after which point the following can be run:Running this command will trigger the Managed Folder istant to run across the mailboxes in question, thus deleting the content.

FlamingKeys

Create a retention tag