Synchronizing Exchange Online/Office 365 User Profile Photos with FIM/MIM

23rd of May, 2017 / / No Comments

Introduction

This is Part Two in the two-part blog post on managing users profile photos with Microsoft FIM/MIM. Part one here detailed managing users Azure AD/Active Directory profile photo. This post delves deeper into photos, specifically around Office 365 and the reason why you may want to manage these via FIM/MIM.

Background

User profile photos should be simple to manage. But in a rapidly moving hybrid cloud world it can be a lot more complex than it needs to be.… [Keep reading] “Synchronizing Exchange Online/Office 365 User Profile Photos with FIM/MIM”

Real world Azure AD Connect: multi forest user and resource + user forest implementation

2nd of December, 2016 / / 17 Comments

Disclaimer: During October I spent a few weeks working on this blog posts solution at a customer and had to do the responsible thing and pull the pin on further time as I had hit a glass ceiling. I reached what I thought was possible with Azure AD Connect. In comes Nigel Jones (Identity Consultant @ Kloud) who, through a bit of persuasion from Darren (@darrenjrobinson), took it upon himself to smash through that glass ceiling of Azure AD Connect and figured this solution out.

… [Keep reading] “Real world Azure AD Connect: multi forest user and resource + user forest implementation”

Completing an Exchange Online Hybrid individual MoveRequest for a mailbox in a migration batch

29th of November, 2016 / / 14 Comments

I can’t remember for certain, however, I would say since at least Exchange Server 2010 Hybrid, there was always the ability to complete a MoveRequest from on-premises to Exchange Online manually (via PowerShell) for a mailbox that was a within a migration batch. It’s really important for all customers to have this feature and something I have used on every enterprise migration to Exchange Online.

What are we trying to achive here?

With enterprise customers and the potential for thousands of mailboxes to move from on-premises to Exchange Online, business analyst’s get their “kind in a candy store” on and sift through data to come up with relationships between mailboxes so these mailboxes can be grouped together in migration batches for synchronised cutovers.… [Keep reading] “Completing an Exchange Online Hybrid individual MoveRequest for a mailbox in a migration batch”

Complex Mail Routing in Exchange Online Staged Migration Scenario

15th of October, 2016 / / No Comments

Notes From the Field:

I was recently asked to assist an ongoing project with understanding some complex mail routing and identity scenario’s which had been identified during planning for an upcoming mail migration from an external system into Exchange Online.
New User accounts were created in Active Directory for the external staff who are about to be migrated. If we were to assign the target state, production email attributes now, and create the exchange online mailboxes, we would have a problem nearing migration.… [Keep reading] “Complex Mail Routing in Exchange Online Staged Migration Scenario”

Understanding Outlook Auto-Mapping

23rd of August, 2016 / / 10 Comments

Auto-mapping is an Exchange & Exchange Online feature, which automatically opens mailboxes with Full Access permissions in a delegate’s Outlook client. The setting is configurable by an Administrator when Full Access permissions are assigned for a user. Once enabled, the periodic Autodiscover requests from the Outlook client will determine which mailboxes should be mapped for a user. Any auto-mapped mailboxes with be opened by the Outlook client in a persistent state and cannot be closed by the user.… [Keep reading] “Understanding Outlook Auto-Mapping”

Configuring Intune Service to Service Connector for Exchange Online with a Service Account

4th of May, 2016 / / 2 Comments

If you are considering the use of Intune Conditional Access with Exchange Online it is generally recommended that you configure the Intune Service to Service Connector.  While it is not mandatory, it does provide your Intune Administrators the ability to report on the effectiveness of the Conditional Access Policies on your mobile ActiveSync clients within your Exchange Online environment.  In addition, if you wanted to enforce the use of the Outlook iOS/Android app using Exchange ActiveSync policies, as per my previous blog post here, setting up the connector would allow you to configure the ActiveSync access rules straight from the Intune Admin Portal.… [Keep reading] “Configuring Intune Service to Service Connector for Exchange Online with a Service Account”

Enforcing Outlook App in Exchange Online and Intune Conditional Access

29th of April, 2016 / / 25 Comments

[UPDATE 23/11/16] Microsoft have announced a new method of doing what I describe in this blog post.  Matt Shadbolt from the Intune Engineering team has a nice blog post that describe how to use this new process, based on Intune MAM policies.  The below information is still useful though if you want to do more specific restrictions (e.g. iOS vs Android native clients).

What is Intune Conditional Access?

Intune Conditional Access is a pretty neat feature that allows administrators to enforce compliance policies to devices prior to allowing them access to sync their mail with Exchange Online.  … [Keep reading] “Enforcing Outlook App in Exchange Online and Intune Conditional Access”

Use MailTips to help avoid those embarrassing email slips

22nd of February, 2016 / / 10 Comments

If you’re like me you probably have a lot of email addresses that auto-complete in Outlook because you spend a lot of your professional life in email.

As some point I bet you’ve also emailed Alan Smith at an external supplier rather than Alan Smyth in accounts because Outlook auto-complete did its thing and you didn’t notice. That is, until that split second after you clicked ‘Send’ or when Alan Smith replied with an email along the lines of “Errrr, don’t think this was meant for me”.… [Keep reading] “Use MailTips to help avoid those embarrassing email slips”

Delegate Mailbox Access using Groups in Exchange Online

8th of February, 2016 / / 4 Comments
A common misconception about granting mailbox access rights in Exchange Online is that you can only add access to the individual and not a group. You may have opened the Exchange Administrator Center (EAC), found the mailbox you wanted and looked at the delegated access tab. Only to be provided with a list of eligible user identity’s, but none of your on-premises security groups that have been created. Fear not, the on-premises groups just need a little remediation to the correct flavour to be seen in the picker and then applied.
… [Keep reading] “Delegate Mailbox Access using Groups in Exchange Online”

Using powershell to add users to an Exchange Online in-place hold

22nd of January, 2016 / / 1 Comment

Originally blogged @ Lucian.Blog. Follow Lucian on Twitter @LucianFrango.

A month ago I wrote a quick post (available here) on removing users from large in-place hold polices in Exchange Online. At the time I wasn’t that familiar with the process and documentation online was limited. After sharing is caring that process I had a deeper look into the in-place hold policies for a client I’m consultant at. There was some cleanup that was required and this post explains that process as well as a streamlined way via powershell to add users to an in-place hold policy.

The problem

Over the course of any large-scale migration to Exchange Online, managed services and project resource teams coordinate to successfully migrate users and apply policies and post migration tasks. In-place hold policies and governance around storing email data for compliance and legal purposes is key for certain organisations. The larger the organisation though, the more tricky the task. The GUI or web console just isn’t enough to cater for thousands of users. Insert powershell!- it is your friend.

The solution

Overall the process to add users to an in-place hold isn’t that much different from the process of removing users from a policy. Like the previous post (available here), I’ll keep the process short and sweet to outline the steps required:

Read More