It's common to find a requirement to create new Microsoft 365 accounts with PowerShell. We're at a point of transition when the old method of using the Azure AD module will switch to the Microsoft Graph PowerShell SDK or Graph API queries. In this article, we explain how to create new accounts and assign licenses with both the Azure AD module and the Microsoft Graph PowerShell SDK.
It's great to be able to run PowerShell scripts using Azure Automation. It's even better when you can create output files in SharePoint Online. In this article, we explain how to create a report of Microsoft 365 Groups subject to the Group expiration policy and generate an HTML report in SharePoint Online using an Azure Automation runbook. Running this kind of job in the background is a great way of processing intensive jobs while you get on with more important tasks.
In November 2016, Microsoft launched the preview version of a new application they called Teams. General availability duly came on March 14, 2017. Five years later, there's no denying the success of Teams and its influence across the Microsoft 365 ecosystem. Along with the success, Teams has had its glitches and failures, but the overall balance sheet is very positive.
One way to protect administrator mailboxes is not to use them. And if you want administrators to use separate mailboxes for their permissioned and non-permissioned activities, that's what you might do. However, we can be smarter and use transport rules to selectively block email sent to administrator mailboxes to dissuade internal people from sending email and blocking all but the most essential email coming in from external domains.
Microsoft has announced a six month extension for support of the Azure AD Graph API. The new deadline is the end of 2022, which gives Microsoft 365 tenants some extra time to convert PowerShell scripts which use the Azure AD and MSOL modules. The original deadline for retirement of the Azure AD license management cmdlets remains at June 30, 2022.
The Microsoft Graph PowerShell SDK is a good way to execute Microsoft Graph API queries from PowerShell scripts. In this article, we explain how to use cmdlets from the SDK with a Azure Automation runbook. The example we use is a script to send a welcome email to new employees.
A year after announcing Teams shared channels, Microsoft is preparing to release the code into public preview in March 2022. The new collaboration mechanism uses Azure AD B2B Direct Connect instead of guest accounts, meaning that external members of shared channels use credentials issued by their home tenant to gain access. You'll need to configure a cross-tenant access policy to allow shared channels to work externally. Once that's done, the collaboration floodgates open.
Microsoft Defender for Office 365 (plan 2) contains the Threat Explorer feature. It's a useful way to investigate problematic messages which arrive in a tenant. The automated investigations feature can highlight messages containing malware by assembling evidence about warning signs in the message or its contents, and administrators can then action the recommendations up to and including the removal of messages already delivered to user mailboxes. Automating investigations is a good thing, if you afford Defender for Office 365 Plan 2.
The number of guest accounts in Azure AD keeps growing, largely due to usage in Microsoft Teams. In this article, we describe five basic management steps to control where guests come how, how they connect, what they can do and access, and removing inactive guests. It's the kind of thing all Microsoft 365 tenants should do.
33 Comments
Azure Automation runbooks can run Exchange Online PowerShell code on sandbox machines. Is this a good way of getting work done? In this article, we examine how to create an Azure automation account, a RunAs account, and some runbooks for PowerShell code to run against Exchange Online and other Microsoft 365 data.
Exchange Online now supports SMTP Strict Transport Security (MTA-STS), a mechanism to help defend SMTP communications between mail servers. Microsoft 365 tenants can decide if they want to enable MTA-STS for their domain by publishing a DNS record and an MTA-STS policy. You don't have to use MTA-STS, but it's a good idea to consider the option.
Over time, Microsoft 365 tenants tend to accumulate large numbers of guest accounts in Entra ID. And over time, some of those accounts become obsolete and inactive. In this article, we explore how to use PowerShell to analyze the activity of guest accounts to figure out what accounts are inactive and which are candidates for removal. It's something you should do annually.
