Category Archives: Administration

Configure Email Forwarding for an Office 365 (Exchange Online) Mailbox – PowerShell

Leave a reply

Configuring email forwarding for an Office 365 (Exchange Online) mailbox can be done in three ways. The user can enable email forwarding on their own using the OWA and editing their settings. This post is going to show how to enable email forwarding on a mailbox from PowerShell. If you are looking at how to complete this with the Exchange Admin Center, please see this post Configure Email Forwarding for an Office 365 (Exchange Online) Mailbox – Exchange Admin Center.

  1. Open a connection to Exchange Online with PowerShell

Make sure to replace “user@domain.com” with the user whose email you want to forward.

Make sure to replace “forward_recipient@domain.com” with the SMTP address to where you want to forward the email to.

  1. If you want to forward email and keep a copy in the local mailbox, execute this command

    Set-Mailbox -Identity “user@domain.com” -DeliverToMailboxAndForward $true
    -ForwardingSMTPAddress “forward_recipient@domain.com”

  2. If you want to forward email and don’t keep a copy in the local mailbox, execute this command

    Set-Mailbox -Identity “user@domain.com” -ForwardingSMTPAddress “forward_recipient@domain.com”

To verify this worked, run the following PowerShell command. This will display the user, the primary SMTP address and the forwarding SMTP address.

Get-Mailbox -Identity “user@domain.com” | Format-List DisplayName,PrimarySMTPAddress,ForwardingSMTPAddress

Office 365 (Exchange Online) Archive Mailbox Size Reporting (Portal)

Leave a reply

To view the size of an Office 365 (Exchange Online) Archive mailbox in the Office 365 portal, follow the instructions below:

If you are looking on how to complete this in PowerShell, please use this article.

Open the Office 365 Admin Portal

Open the Exchange Admin Center

Click Recipients

Click Mailboxes

Select the User Mailbox

Click View Detail in the In-Place Archive

Details are displayed

Blocking Apps from Using EWS

2 Replies

If your reading this post, you were probably asked by your security team to block a certain app or apps from accessing Office 365 (Exchange Online). There are all kinds of security reasons that you would need to block applications from using Exchange Web Services (EWS). I am in no way picking on any one application, the one shown in the post below just happens to be the one that I was asked to block by a client. Their security team reviewed the app and it didn’t meet their corporate security policy.

In order to block EWS applications, we need to use the Set-OrganizationConfig command, and then specify two EWS parameters.

 

Let’s first review your organization and see if you have a Block List setting and if there are applications in there.

 

Connect to Exchange Online with PowerShell

 

$UserCredential = Get-Credential

 

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection

 

Import-PSSession $Session

 

Verify Existing Settings

 

Get-OrganizationConfig |ft Name,EwsApplicationAccessPolicy,EwsBlockList,EwsAllowList

 

From the results above we can see that the EwsApplicationAccessPolicy is not set and there is nothing in the EwsBlockList or the EwsAllowList

 

Understand the Process (EwsApplicationAccessPolicy and EwsBlockList or EwsAllowList)

 

There are two basic methods to blocking applications. Most companies that I work with want to allow everything and target specific apps to block.

 

You can block everything except everything on the allow list; EnforceAllowList

-or-

You can allow everything and except what’s on the block list; EnforceBlockList

 

-EwsApplicationAccessPolicy <EnforceAllowList | EnforceBlockList>

The EwsApplicationAccessPolicy parameter defines which applications other than Entourage, Mac Outlook, and Outlook can access EWS. If set to EnforceAllowList, only applications specified in the EwsAllowList parameter are allowed access to EWS. If set to EnforceBlockList, every application is allowed access to EWS except the ones specified in the EwsBlockList parameter.

 

-EwsBlockList

The EwsBlockList parameter specifies the applications that can’t access EWS when the EwsApplicationAccessPolicy parameter is set to EnforceBlockList.

 

-EwsAllowList

The EwsAllowList parameter specifies the applications (user agent strings) that can access EWS when the EwsApplicationAccessPolicy parameter is set to EnforceAllowList.

 

 

Enable the Block List and add an Application

 

This method will show how to allow all applications (that use EWS) and only block ones on the block list. You’ll see the command to block a specific application and then the confirmation command after.

 

Set-OrganizationConfig –EwsApplicationAccessPolicy:EnforceBlockList –EwsBlockList:”CloudMagic*”

 

Given some replication and policy time the user will see this.

 

Thanks for visiting and reading my posts. I am always looking for more ideas. Please comment or email me with what you would like to see.

Kelsey Epps Office365 MVP

Email Me Follow me on Twitter Connect with me on LinkedIN

Modify Recoverable Items Folder – RetainDeletedItemsFor

Leave a reply

Once you delete items from Outlook or have retention policies delete the data, it will end up in the Recoverable Items Folder. This post will detail how to check for and modify the time in which that data sits in the Recoverable Items Folder, before it’s purged from Exchange Online.

Chances are if you are reading this you know what the Recoverable Items Folder is and you know why you want to change the default time for the folder. Please be careful and be knowledgeable about how and what you are modifying here.  If you are unsure about the Recoverable Items Folder, please view the Microsoft TechNet article below. Consider this as your warning.

https://technet.microsoft.com/en-us/library/ee364755(v=exchg.150).aspx

 

Per Microsoft:

To protect from accidental or malicious deletion and to facilitate discovery efforts commonly undertaken before or during litigation or investigations, Microsoft Exchange Server 2013 and Exchange Online use the Recoverable Items folder. The Recoverable Items folder replaces the feature that was known as the dumpster in earlier versions of Exchange. The Recoverable Items folder is used by the following Exchange features:

  • Deleted item retention
  • Single item recovery
  • In-Place Hold
  • Litigation Hold
  • Mailbox audit logging
  • Calendar logging

 

This BLOG post will walk through the steps of setting the RetainDeletedItemsFor value for both the Mailbox and the Mailbox Plan in Office 365 (Exchange Online). The Microsoft default value for this setting is 14 days. The value is modified with PowerShell connection to Exchange Online. One thing to note is that if you have changed the default value on premise, you will also have to set the same value in Exchange Online as the mailbox you are moving to Exchange Online will get the value from Exchange Online.

 

View the current MailboxPlan settings in Exchange Online

Get-MailboxPlan |ft Name,RetainDeletedItemsFor

 

View the current setting per mailbox in Exchange Online

Get-Mailbox -Identity User.Name | fl Identity,RetainDeletedItemsFor

 

View the current setting all Mailboxes in Exchange Online

Get-Mailbox | fl Identity,RetainDeletedItemsFor

Note that some of the names have been blacked out for security purposes. Yes, people try to hack the users in my blog posts, even though I only use them once and they are deleted after.


 

Changing the Default Values

The value can be changed per mailbox or for the whole mailbox plan. Per mailbox is just as it sounds, it’s only for that one mailbox. Per mailbox plan will catch all the newly created mailboxes (including those migrated). It’s important to note that if you modify the setting after mailboxes have been created or migrated to Exchange Online, you will have to modify the value on those mailboxes as well as the mailbox plan. Basically after modifying the mailbox plan, all new mailboxes will get the new setting, while existing mailboxes will have to be updated.

 

The default value is set to 14 days. The max value that you can set is 30 days.

 

Change the current setting for the MailboxPlan in Exchange Online

Get-MailboxPlan | Set-MailboxPlan -RetainDeletedItemsFor XX

The screen shot below shows the command to change the setting, followed by the command to verify.

 

Change the current setting per mailbox

Set-Mailbox –Identity username@domain.com -RetainDeletedItemsFor XX

The screen shot below shows the command to change the setting, followed by the command to verify.

 

Thanks for visiting and reading my posts. I am always looking for more ideas. Please comment or email me with what you would like to see.

Kelsey Epps Office365 MVP

Email Me Follow me on Twitter Connect with me on LinkedIN

Office 365 Shadow Tenants – Sorry, you can’t add domain.com here because it’s already in use

14 Replies

Sorry, you can’t add domain.com here because it’s already in use. If you own the domain.com domain and want to manage it, you have a couple of options.

 

This issue has come up a number of times with my clients. We are unable to add and verify production domains to a production tenant, because someone in the orgainization has used the company email address and signed up for a trail PowerBI (etc..) accounts. Because of the way that Office 365 is setup, when you sign up for those trials, a shadow tenant is created and your domain is locked (unverified) to that tenant. In my example, I have opened a trail for PowerBI, using an email address (kelsey.epps@office365testing.org) that hasn’t been registered with my production Office 365 tenant. Now, when I try to add the domain (office365testing.org) to my production Office 365 tenant, I get the error below (in red and screen shot). This is because the shadow tenant that was created for PowerBI trial is using that domain.

In order to resolve this, you will need to do an admin takeover of the shadow tenant and then release the domain so that it can be registered to your Office 365 tenant. This involves you opening another trial to PowerBI, taking admin ownership and verifying the domain in the shadow tenant, removing the domain from the shadow tenant and then adding and verifying it into your tenant.

 

Sorry, you can’t add domain.com here because it’s already in use. If you own the domain.com domain and want to manage it, you have a couple of options.

 

 

Follow these instructions to remove the domain from the Shadow tenant and add it to your production tenant.

 

Navigate to https://powerbi.microsoft.com/

 

Enter your email address (that includes that domain that you can’t add to your Office 365 tenant). My example is office365testing.org

 

Click ‘Use it free’

 

A confirmation email will be sent to your account. Click the link to verify the email address.

 

 

Enter your First Name, Last Name and a password. Click Start

 

The PowerBI setup process will kick off and your account will be added to the Shadow Tenant


 

Click the Office 365 waffle (app launcher)

Click the Admin Icon

 


 

This will take you to the admin take over webpage

Click ‘Yes, I want to be the admin’

 

Add the verification TXT record to your external DNS. Mine happens to be hosted on GoDaddy, so there are instructions for GoDaddy on the page.

 

 

Once the TXT record is added to public DNS, give it some time for replication. This is generally completed within 30 minutes, but can take up to 72 hours.

Click ‘Okay, I’ve added the record’

 

The process will now go out and verify that the TXT record supplied is added to public DNS. Once completed, your account will be added as the admin for the shadow tenant.

 

Click ‘Go to the Office 365 homepage’ or login to https://portal.office.com with your account.

Once logged into the Office 365 Admin Portal, click Users -> Active Users

This will show you all the people that have opened trail accounts of PowerBI

 

In order to remove the domain, so that we can register it in the main tenant, you need to edit the users and change the UPN to the onmicrosoft.com domain (in my example – office365testingorg.onmicrosoft.com). This is required because none of the users can have the office365testing.org domain in use, if we want to remove the domain from this tenant. It’s recommended that you update all the users and then your admin account.

Double click a user and change the UPN to the domain.onmicrosoft.com address

Click Save

 

You may receive a warning. Click Yes

Repeat for all the users

Let your users know they still have their trial accounts, but the user name is now changed. This will allow them to remove their data.

 

Edit your admin account the same way

Click Yes to the warning

Click OK and sign out of the shadow tenant

Sign back in with the new user name (user@domain.onmicrosoft.com)

 

Click Domains and select the domain you want to remove (this is the domain that you want to add to your production tenant)

 

With the domain selected, click ‘Remove domain’

Click Yes

The domain will be removed from the shadow tenant and is not free to add to your tenant (give the process some replication time across the Microsoft backend servers).

Logout of the shadow tenant

 

Login to your production tenant where you were getting the error adding the domain with your admin account and try to add the domain again. This time it should work without giving you the error. Please note that you will have to verify ownership again by adding the TXT record into public DNS.

 

Login to the production tenant – https://portal.office.com

Navigate to domains

Click
+ Add domain

 

Click ‘Let’s get started ->’

 

Add the newly released domain from the shadow tenant

Click Next

 

Verify domain ownership. Since I use GoDaddy, the process will allow me to sign into my GoDaddy account and verify, or use a TXT record in public DNS. Since I am lazy, I will just sign into GoDaddy and let automation rule my life. 😉

 

Success (and I forgot to screen shot the page before clicking next) … The domain is now verified and added to your production tenant. Step through the rest of the steps and now when viewing the domains in the production tenant, you will see it there and verified.

 

 

Thanks for visiting and reading my posts. I am always looking for more ideas. Please comment or email me with what you would like to see.

Kelsey Epps Office365 MVP

Email Me Follow me on Twitter Connect with me on LinkedIN

 

 

 

 

 

 

 

 

 

List and Export the Admin Roles Assigned to Users in Office 365 with PowerShell

3 Replies

If you didn’t know, you can use the Office 365 Admin portal to view and create views of all the admin roles in Office 365 and who is assigned to each of those roles. This is good for a quick reference, but sometimes we need that data in a workable format (CSV). The following step-by-step will show you how to list and export the admin roles assigned to users in Office 365 with PowerShell. This is done with the Get-MsolRoleMember command in PowerShell

 

Connect to Azure Active Directory with PowerShell

Enter the command $role = Get-MsolRole -RoleName “Company Administrator”

Enter the command Get-MsolRoleMember -RoleObjectId $role.ObjectId | Export-CSV c:\directory\filename.csv

This will export all the members of the Company Administrator (Global Admin) group.

 

If you want to export from the other built-in groups, a list is provided below. You can always view the roles by entering the command Get-MsolRole

 

Name Description
Compliance Administrator Compliance administrator.
Exchange Service Administrator Exchange Service Administrator.
Partner Tier1 Support Allows ability to perform tier1 support tasks.
Company Administrator Company Administrator role has full access to perform any operation in the company scope.
Helpdesk Administrator Helpdesk Administrator has access to perform common helpdesk related tasks.
Lync Service Administrator Lync Service Administrator.
Directory Readers Allows access to various read only tasks in the directory.
Directory Writers Allows access read tasks and a subset of write tasks in the directory.
Device Join Device Join
Device Administrators Device Administrators
Billing Administrator Billing Administrator has access to perform common billing related tasks.
Workplace Device Join Workplace Device Join
Directory Synchronization Accounts Directory Synchronization Accounts
Device Users Device Users
Partner Tier2 Support Allows ability to perform tier2 support tasks.
Service Support Administrator Service Support Administrator has access to perform common support tasks.
SharePoint Service Administrator SharePoint Service Administrator.
User Account Administrator User Account Administrator has access to perform common user management related tasks.

 

Thanks for visiting and reading my posts. I am always looking for more ideas. Please comment or email me with what you would like to see.

Kelsey Epps Office365 MVP

Email Me Follow me on Twitter Connect with me on LinkedIN

Adding a Domain to Office 365 that is Registered with GoDaddy

Leave a reply

Adding a domain to Office 365 is really easy. To make the process even more wasy, the web page walk you through it. For this post, I am addding a domain to Office 365 that is managed at GoDaddy

 

Open the Microsoft Online Portal

Click Domains

Click + Add Domain

 

The add a domain in Office 365 Window will popup.

Click Let’s get started to allow the webpage to discover your domain registrar

 

Enter the domain you want added to Office 365

Click Next

 

Domain ownership needs to be verified. In this case, it was discovered that the domain is registered at GoDaddy.

If you want the web page to do all the steps, sign in with your GoDaddy account

If you want to verify the domain manually, then click ‘use a TXT record to verify you own this domain’

 

Sign in to your GoDaddy account

 

To confirm Office 365 access to your domain at GoDaddy, click Accept

 

The domain is verified

Click Next

 

At this point, you have the option to convert all the domain.onmicrosoft.com UPNs on the users to domain.com.

You can skip this if you wish, see below.

 

Click Update selected users to update the users, or click skip this step if you wish not to update the UPN

 

The next step in the process allows you to add more users, or you can skip the step.

 

Update DNS records. Be really careful here. If you have a production domain and you are using it for production email or other services, then changing DNS can cause some havoc if you are not ready to flip the services to Office 365. In my case, this is a test domain and I have no production users on it.

Click Next

 

Click Next

Keep in mind that I want the web page to change my DNS records, so I am leaving the Outlook and Lync checked.

 

Here is a screen shot of my DNS records before the webpage makes it’s changes to DNS

 

Here is a screen shot of the DNS records that the web page added, to enable services on Office 365

 

 

Done, the domain is added and now active for Office 365 use.

Click Finish

 

Thanks for visiting and reading my posts. I am always looking for more ideas. Please comment or email me with what you would like to see.

Kelsey Epps Office365 MVP

Email Me Follow me on Twitter Connect with me on LinkedIN