Mastering Office 365 and Microsoft 365
In MC877369, Microsoft announced the availability of three Copilot usage reports in the Graph usage reports API to track usage of Copilot for Microsoft 365 in the apps enabled for Copilot, like Outlook, Excel, Word, PowerPoint, Loop, etc. The data available in the Copilot usage reports isn’t very informative and you might be better off using audit records to analyze what’s happening.
The Microsoft 365 Licensing Report PowerShell script has been upgraded to generate detailed license information and to deal with expired license subscriptions. You can download V1.94 of the script from GitHub. Before attempting to run the licensing report script, take the time to read previous articles to understand the basics of the script and how to generate the files used for pricing information.
The Microsoft 365 admin center will support continuous access evaluation (CAE) from September 2024 to help revoke access from accounts more quickly when critical events happen (like an account password being changed). Adding CAE support to an admin center is always a good idea, but it shouldn’t take away from the need to protect Microsoft 365 accounts with multifactor authentication. Stop compromise before you need to react to compromise!
eDiscovery is a calling best left to skilled investigators. But Microsoft 365 administrators need to know how to search and how the new Purview eDiscovery works. The new implementation is due by the end of 2024 and is in preview now. It unifies the three existing solutions in the Microsoft 365 eDiscovery space and promises to deliver new functionality. But will it make its dates? Who knows!
One of the things that vexes me is the need to change account to attend a Teams meeting. I forget this all the time and end up with unexpected waits in virtual lobbies, twiddling my thumbs while waiting for someone to admit me to the call. Sometimes I end up missing calls because people can’t admit participants from outside the tenant if they don’t have a guest account. The solution might come from the application of more intelligence and a change to the Teams UI.
The automatic document summary feature for Word duly turned up and Copilot for Microsoft 365 has been busy generating summaries ever since. The feature works well for documents with less than 80,000 words, which should be enough for most documents but limits summarization for documents that might use it most, like complex plans or contracts. In any case, I haven’t found a way to turn document summaries off. Maybe that’s coming.
Thankfully, Teams pasted text no longer contains a timestamp and the author’s name. The change is effective worldwide and addresses a longstanding irritation. Quite why it took so long for Microsoft to understand how people felt about the insertion of unwanted metadata is a mystery, but it’s gone now. And in other news, Mic Pending is a new feature for Teams calls and meetings.
People often need to transfer objects or code between Microsoft 365 tenants. When it comes to dealing with objects, the Microsoft Graph PowerShell SDK’s ToJsonString method is very useful. The method outputs a string containing JSON content, but only for object properties that have a value. This makes the much easier to use the output as the basis for a template object or as the payload body to create an object in another tenant.
Files are available to download for the September 2024 update for the Office 365 for IT Pros (2025 edition) eBook. This is monthly update #111 for the only book covering Microsoft 365 that’s updated monthly. As normal, this update covers a bunch of new information and insights from across the Microsoft 365 ecosystem.
After reaching 50% deployment and on track to general availability, Microsoft decided to withdraw the Copilot catch up feature. Catch up shows a set of cards in a carousel to highlight documents and other items that Copilot believes are of interest to the user. It’s like the insights surfaced in other places within Microsoft 365, such as Office applications, Viva Insights, and Delve.
On August 21, 2024, news emerged that the PnP PowerShell module will transition from using a multi-tenant Entra ID app to a tenant-specific app. The change is scheduled for September 9, 2024, which doesn’t leave a lot of time available for developers to review, update, and test PowerShell scripts based on PnP PowerShell. Some extra warning would have been nice.
The ability to restore deleted groups only covers Microsoft 365 groups. That’s an odd situation to be in given the different types of groups in Microsoft 365, and the reasons why things work (or don’t) the way they do is down to history and different teams within Microsoft. It’s logical that customers assume they can restore any type of deleted group. Microsoft needs to do some magic to make that assumption real.
Microsoft Purview and the Exchange Online Search-UnifiedAuditLog cmdlet both perform searches of the Microsoft 365 unified audit log. Both mechanisms support the concept of scoped searches to limit audit records returned by searches to the administrative units an account can manage. But the permissions assigned by the two mechanisms aren’t synchronized, which can lead to complications.
Shared mailboxes have Entra ID accounts. No one needs to sign into the accounts because Exchange Online manages connections using mailbox permissions. But it can happen that people do sign into shared mailboxes and if the accounts aren’t licensed, they don’t comply with Microsoft licensing requirements. As explained here, some PowerShell can check for potential licensing violations.
Microsoft says that they plan to refresh the Teams external domain activity report from September 2024. But access to the report requires a Teams Premium license. It seems like this kind of fundamental information should be available to every tenant as it’s not basic security data instead of something that could be considered as Advanced Collaboration Analytics.
Microsoft announced their plan to charge for unlicensed OneDrive for Business accounts in July. Now we have an unlicensed OneDrive accounts report in the SharePoint Online admin center. The report divides unlicensed OneDrive accounts into four categories and it’s up to Microsoft 365 tenant administrators to figure out whether to retain or remove unlicensed accounts before automatic archival comes into force in January 2025.
The decision to rationalize license management in the Microsoft 365 admin center wasn’t popular but the signs are that it could deliver benefits to customers in the form of new features and functionality. The first updates are a GUI to manage self-service purchases and trials together with notifications to administrators when a user makes a self-service purchase. More needs to happen, but positive indications are there.
A recent report highlighted the problem of on-premises accounts synchronized to Entra ID that receive administrative role assignments. This article explains how to report the administrative role assignments managed by Privileged Identity Management (PIM) or direct role membership so that it’s easy to highlight on-premises accounts holding administrative roles.
Microsoft’s project to impose a mandatory MFA requirement for access to Azure management tools and sites will start enforcement on or after October 15, 2024. The new requirement will only affect administrator accounts who access Azure sites and tools (like PowerShell). Normal users shouldn’t notice any difference. The Azure MFA requirement is a great way to drive home the need for MFA to protect Microsoft 365 administrator accounts against attack. Prepare now!
The August 15 announcement that Microsoft Copilot (the version that doesn’t use the Graph) will benefit from enterprise data protection from September is good new. However, Microsoft said nothing about the security issues around Copilot for Microsoft 365 reported at the recent BlackHat USA 2024 conference. In other news, tenants can pin Microsoft Copilot to app navigation bars using a new control in the Microsoft 365 admin center.
The Usage Reports Graph API is now generally available, which means that it’s fully supported. In other news, a Graph API is available for Microsoft 365 Backup, The news demonstrates once again how widely the Graph APIs are used with Microsoft 365 and why tenant administrators should acquire some knowledge about how the Graph works.
The AuditLog Query Graph API remains in beta status but cmdlets are now available in the Microsoft Graph PowerShell SDK. This led to some oddities in results when the number of audit events found by a search didn’t match those reported by the Purview compliance portal. It all worked out in the end. In other news, the Set-MgRequestContext helped sort out some retry problems.
HVE and ECS are two competing Microsoft Cloud Email Services. At least, they seem to compete. In reality, HVE and ECS serve different target audiences. HVE is all about internal email services for apps and devices while ECS is for high volume external mailings like customer newsletters. We tested both services by sending subscription reminder notifications to Office 365 for IT Pros readers.
When someone leaves a Microsoft 365 organization, the possibility exists that they leave some active Teams online meetings dangling behind them. What can be done to take over these meetings and make someone else the meeting organizer? The answer is simple: nothing. Organizing a replacement meeting is one way out, but maybe it’s best to use a dedicated account to organize important company events.
Microsoft is removing license assignments from the Entra admin center. From Sept 1, new license assignments are done in the Microsoft 365 admin center. In other news, a new Self-service trials and purchases page is coming to the Microsoft 365 admin center to control the ability of users to purchase self-service licenses or use trial licenses.
A question asked about filtering Teams apps based on their blocked status. The Teams admin center doesn’t support this kind of filter and getting details of Teams apps is surprisingly difficult. For instance, you can’t get a list of the 2,500+ apps shown in the Teams admin center. PowerShell cmdlets are available to list Teams apps, but they focus on apps known to a tenant rather than the entire catalog.
Tenant administrators know that they need to deal with mailboxes and OneDrive accounts when people leave, but what about Teams chat messages? Or rather, the information stored in the compliance records captured in Exchange Online mailboxes? Reviewing chat messages can be an ardous task, so perhaps the solution might be to export the compliance records to a PST for long-term retention.
Teams meeting transcripts are enormously helpful and are used by many features, including Copilot for Microsoft 365. Access to transcript files needs good control because of the possibility of confidential information being captured in transcripts. Several recent changes made to the Teams meeting policy and meeting options help organizations to exert better control over access to transcript files.
MC837081 announces that the Microsoft 365 admin center is to lose its ability to send password in email after updating a user account. It’s the right thing to do because sending passwords in email is bad practice and encourages people to treat passwords with less respect than they should. The long term solution is to move away from passwords, but it will take time before Microsoft 365 is passwordless.
The Microsoft FY24 Q4 results delivered solid growth in Microsoft Cloud revenues. No new numbers were given for Office 365 or Teams users, possibly because of a slowdown in new user acquisition. We learned that Teams Premium now has more than 3 million users and that Copilot for Microsoft 365 is being used by more customers than ever before, but without real numbers it’s hard to say just how well things are going.
The first update for Office 365 for IT Pros (2025 edition) or monthly update #110 is now available for subscribers to download. The update covers both the Office 365 for IT Pros and Automating Microsoft 365 with PowerShell books. Many of the changes in this update are small but we do have some new information to share in some chapters.
Teams ACM replaces app permission policies with an easier method of defining who can use Teams apps. A wizard in the Teams admin center runs a one-time non-reversable switchover from app permission policies to ACM and makes sure that the permissions assigned through policy are present for each app. In other news, Teams is much better at presenting Graph permissions that apps need to run.
Microsoft plans to archive unlicensed OneDrive sites starting in January 2025. The obsolete sites will end up in Microsoft 365 archive, from where the sites can be reactivated for a small per-gigabyte fee. Archived sites are indexed and discoverable. However, the message is clear: remove unlicensed OneDrive sites now. They’re only cluttering up your digital landscape and might give Copilot for Microsoft 365 a headache.
The task to find manager for Entra ID accounts seems simple until you find the bunch of utility accounts created by Exchange Online that should be ignored. This makes the task more “interesting” when the time comes to find user accounts that don’t have assigned managers. Eventually, all the filters work, and you have a result, but the task is more complicated than it should be.
All software has unique quirks, and the foibles of the Microsoft Graph PowerShell SDK are well known. But it’s much harder when the underlying foundation contributes to the craziness as described in this article. Graph pagination works in a specific way and Microsoft tunes the Graph to deliver great performance by reducing the set of properties returned for objects. Both can cause concern for developers.
On the surface, the work to delete OneDrive for Business accounts seems straightforward because Microsoft provides a 30-day deletion period to review contents and uses an automatic delegation process to assign control over the account to the deleted user’s manager. But given the number of applications that store data in OneDrive for Business, can anyone perform an end-to-end review of what’s in the account in a reasonable time?
In a change designed to reduce the consumption of storage quota, Stream video versions are no longer being generated for non-video updates such as changes to video metadata. Anything that alters the video content, like trimming some seconds from the start or end of a video, will create a new version. It seems like a perfectly reasonable change to make that might help SharePoint storage not be consumed quite so quickly.
The Microsoft 365 licensing report now supports a cost center analysis based on cost center values stored in an Exchange custom attribute. The new analysis is entirely optional, but it seems like many tenants store cost center values in custom attributes, so this update might work well for them. That is, if the cost center data stored in Exchange is accurate… Rubbish in always means rubbish out…
Every Microsoft 365 tenant must deal with ex-employee mailboxes. The default choice is to make the mailboxes into shared mailboxes. But inactive mailboxes could be a better option to deal with the requirements to preserve user privacy and avoid inadvertent disclosure of PII to people who don’t need that information. Perhaps it’s time to reassess how your organization deals with ex-employee mailboxes?
