Office 365 for IT Pros (3rd edition) – Change Log for Updates


Office 365 for IT Pros is intended to be a “living” book. In other words, the content we published when the book first appeared on June 1, 2016 is under constant review in light of developments that occur, typos and other issues that we find and fix, and comments that come in from readers. Depending on the demand of other work and the importance of new information, we might build new versions of the book on a daily or weekly basis.

O365ITProDate

Viewing the date that the book was updated (EPUB version)

The current version of the book is dated 24 September 2016. Updates are provided free of charge to those who bought the third edition. The exact mechanism depends on where you purchased the book.

  • If you bought from ExchangeServerPro.com and registered an account, you can download free updates for (PDF and EPUB formats) the edition that you purchase from the site.
  • If you buy a Kindle version from Amazon, you can download free updates from Amazon.com. You do this from the Amazon site by going to Manage Content and Devices, select the book, and click on Update Available. Amazon can sometimes be slow at making updates available through this route (they want to avoid lots of extra downloads, so they force authors to go through hoops before they release an update). If an update doesn’t show up, you might have to ask Amazon support to delete the entry in your list and get a refreshed copy of the book.
  • Free updates are not available to people who receive copies distributed by third parties. We provide updated content to companies who buy from us in order that they distribute the latest available text, but we don’t have a way to reach those who receive books in this manner thereafter.

Here’s the list of the changes made to date. The number of changes across multiple chapters gives you an idea of how hard it can be to keep up with technology updates inside Office 365…

Overall

June 2-6: Changes to improve flow of book in EPUB and MOBI formats. Most of the work has occurred around PowerShell examples and the “Note” blocks.

July 15: Changed the way that note blocks are formatted to prevent some problems of characters being cut off when the EPUB version is read on iPad/iPhone. Readers who like to use the EPUB version should download the new version.

September 1: Changeover from Binary Tree to QUADROtech as the main sponsor for the book.

Chronological updates

Date Chapter Change
24 Sept 7 (Mailboxes) Using the Set-MailboxCalendarConfiguration cmdlet to stop Exchange creating calendar events from emailed notifications.

Rewritten section on expandable archives.

Fixed error in table 7-1 that listed shared mailboxes as having an unlimited quota.

24 Sept 9 (Office 365 Groups) Outlook Groups app now has an iPad version.
24 Sept 22 (Delve) Analytics link in the Delve navigation bar has been changed to MyAnalytics
19 Sept 5 (Office 365 management) Add reference to TechNet Gallery license reconciliation report.
19 Sept 9 (Office 365 Groups) Make it clear that guest access to Office 365 Groups does not respect the SharePoint Online whitelist for domains to which sharing invitations can be sent.

Limit of 300 subscribers for a group has been lifted

New example of creating a group from a SharePoint team site

19 Sept 19 (Reporting and Auditing) Extra detail about Exchange admin auditing plus the addition of reasons why you’d use a third-party reporting product rather than the standard Office 365 reports.
14 Sept 2 (Making the decision) Microsoft provided the Q2 2016 SLA data for Office 365.
14 Sept 9 (Office 365 Groups) Ability to control issuing of AAD sharing invitations to external users now in Office 365 Admin Center
12 Sept 9 (Office 365 Groups) Section added to describe the support for external guest user to Office 365 Groups.
12 Sept 10 (Planner) Explain that guest access for Groups does not yet mean that the same access is available for Plans. Also note that changing a plan type from private to public can have unexpected consequences.
12 Sept 12 (Addressing) Note that Exchange Online supports a maximum of 100 proxy addresses for a mailbox (the actual limit is higher). [Updated also on 24 Sept]
12 Sept 14 (Mail Flow) Additional notes on S/MIME and Safe Links
12 Sept 16 (Retention) Explain why the recoverable item quota is often exceeded.
7 Sept 5 (Managing Office 365) Note about #EXT# accounts found in Azure Active Directory and whether or not they can be deleted.
7 Sept 7 (Mailboxes) Introduction of Restore user mailboxes walkthrough.
7 Sept 14 (Mail Flow) Additional information about spoof intelligence available through the Security and Compliance Center.
7 Sept 18 (Protection Center) 1.      Note that it’s possible to export all the contents of a mailbox to a PST through a content search (mimic on-premises New-MailboxExportRequest)

2.      Export of multiple searches in an eDiscovery case can now be done at one time.

3.      Introduction of the special “all case content” search for eDiscovery cases.

7 Sept 19 (Reporting and Auditing) New audit event sources (Sway, eDiscovery, Power BI)
1 Sept 2 (Making the decision) More detail about the number of TCP/IP sessions that users can consume when connecting to Office 365 services
1 Sept 4 (Migration) Inclusion of pointer to free eBook about PST migration that’s available from QUADROtech.
1 Sept 4 (Migration) Addition of section covering the import of legacy email archives to Office 365.
1 Sept 9 (Office 365 Groups) Groups will now have a SharePoint team site and the maximum size of a site collection is now 25 TB.
1 Sept 16 (Retention) Clarification of what happens when a retention tag is updated.
1 Sept 22 (Delve) Mention that anonymized data from five active users is required before Delve Analytics shows company averages to users.
1 Sept 23 (Doing more) Maximum size of SharePoint site collection is now 25 TB. Office 365 Groups now have a default team site.
1 Sep 24 (Sponsor chapter) Replacement of sponsor content provided by Binary Tree with content provided by QUADROtech, our new sponsor.
26 Aug 16 (Clients) New architecture for the Outlook for iOS and Android apps plus removal of section covering BlackBerry services, which are being deprecated inside Office 365.
26 Aug 22 (Delve) New Delve UI for cards and document views replaced old content.
22 Aug 4 (Migration) Clarify that the Office 365 import service applies retention holds to mailboxes that are targets for data imports.
22 Aug 9 (Office 365 Groups) The More menu item in the OWA interface now links to Planner.
22 Aug 10 (Planner) The More menu item in the OWA interface now links to Planner.
17 Aug 19 (Reports and Auditing) Clarify some elements of mailbox auditing.
15 Aug 18 (Security and Compliance) New permissions available for the role groups used for the Security and Compliance Center.
15 Aug 19 (Reports and Auditing) Note about PowerShell access to activity alerts (Get-ActivityAlert etc.)
15 Aug 23 (Doing more) Versioning of OneDrive and SPO libraries can offer a solution against ransomware and other virus attacks.
10 Aug 18 (Security and Compliance) It’s now possible to export content search results from Exchange mailboxes to individual MSG files. Section updated to reflect this and the addition of an option to export just the search reports.
10 Aug 19 (Reporting and Auditing) Section on Activity Alerts added.
5 Aug 7 (Mailboxes) Emphasize that archive mailboxes cannot be used to store information originating from multiple users.
5 Aug 9 (Office 365 Groups) Option to convert a distribution group to an Office 365 Group is now available in the EAC.
5 Aug 17 (eDiscovery) Note that a maximum of ten journal rules can be configured for an Office 365 tenant.
5 Aug 23 (Doing more) You can now add people information to an uploaded video in Office 365 Video.
2 Aug 8 (Managing other mail-enabled objects) Note that applying a distribution group naming policy for Office 365 will cause groups synchronized from on-premises to be stamped with new names (according to the policy).
2 Aug 9 (Office 365 Groups) Emphasize that it is best practice to make a sensitive group private to avoid any chance of documents being unearthed by Delve.
2 Aug 13 (Hybrid recipients) Note about the distribution group naming policy.
2 Aug 15 (Clients) Added information about ActiveSync protocol v16.1. Added new mobile device authentication section to call out the preview availability of certificate-based authentication for Exchange Online. Updated information about the migration from AWS to Azure-hosted services Outlook for iOS and Android. Added section introducing Microsoft Intune, and the decision around choosing standalone Intune or a hybrid MDM model by integrating Intune with SCCM.
28 July 3 (Identities and authentication) Change in the way that UPNs are synchronized for accounts that have Office 365 licenses assigned.
28 July 11 (Public Folders) Clarification about Outlook 2016 for Mac access to public folders.
28 July 22 (Delve) The Delve Analytics add-in app for Outlook is now automatically deployed when user accounts are enabled for Delve Analytics.
28 July 23 (Doing more) Mention that the Focused Inbox will replace the Clutter feature eventually.
26 July 9 (Office 365 Groups) Added section about how to check for obsolete groups.
26 July 19 (Auditing and Reporting) New parameters for the Search-UnifiedAuditLog cmdlet mean that you don’t have to use the ConvertFrom-JSon cmdlet to read the audit data any more. Code examples updated.
22 July 6 (Hybrid connections) Introduction of the minimal configuration for a hybrid connection mandated rewrites of several sections.
22 July 9 (Office 365 Groups) Updated to reflect fact that Office 365 Groups can now be managed through the Exchange Online Admin Center. Also updates in section about migrating distribution groups to Office 365 Groups to provide additional examples.
20 July 1 (Introduction) Added note about Microsoft’s assertion that 40% of enterprise Office 365 tenants use EMS. Also updated section on the commercial success of Office 365 following Microsoft’s FY16 Q4 results.
20 July 7 (Managing mailboxes) Note that the use of the last name, first name convention for display names can end up with seemingly odd initials in Office 365 avatars.
20 July 20 (IRM) Add section covering the preview of Azure Information Protection.
20 July 21 (DLP) Add note that the OneDrive for Business mobile apps can now display DLP policy tips.
20 July 23 (Doing more) 1.      News that the Yammer-based Office 365 Network is being replaced by network.office.,com.

2.      Microsoft Stream will eventually merge with Office 365 Video and provide that service to tenants.

13 July 1 (Introduction) Add more information about Office 365 plans.
13 July 5 (Managing Office 365) Updated section on Message Center including new version of Figure 5-11 to show off new icons. Figure 5-12 updated with a more interesting example.
13 July 18 (Security and Compliance) Updated description of content searches to reflect introduction of “Search everywhere” option. Also additional detail about re-establishing holds after a closed eDiscovery case is reopened.
13 July 22 (Delve) New version of the Delve Analytics Outlook add-in app released. Figures and text updated.
9 July 8 (Mail-enabled objects) Rewrote section of group naming policy to clarify how the properties are used.
9 July 13 (Hybrid Recipients) Remove erroneous $True value passed to AutoComplete parameter in PowerShell example of creating a migration batch
9-July 20 (IRM) Clarify what happens when protected messages cannot be indexed.
4 July 8 (Mail-enabled objects) Rewrote section on Email redirection for better clarity and to reflect recent changes in how the Email Forwarding option is handled by the Office 365 Admin Center.
1 July 9 (Office 365 Groups) Clarify why a limit exists for the number of groups that a single user can create.
30 June 7 (Managing mailboxes) Using MAPI/HTTP endpoint to find the current location of a mailbox
30 June 19 (Reporting and auditing) Expanded discussion about the Office 365 Unified Auditing system.
28 June 20 (IRM) Added section about using IRM usage logs to track how people use IRM within a tenant.
24 June 1 (Introduction) Add new section to summarize the benefits of Azure Active Directory Premium licenses to Office 365 tenants
24 June 3 (Identities) Minor updates based on change made to Chapter 1.
24 June 9 (Office 365 Groups) Rewrote section on the cost of dynamic Office 365 Groups because some of the information is now in Chapter 1.
23 June 9 (Office 365 Groups) Updated Figure 9-10 to show new @All capability in use and rewrote surrounding text to explain its use.
22 June 14 (Mail Flow) Emphasize point that new mail hygiene features will show up in the Security and Compliance Center rather than EAC.
22 June 18 (Security and Compliance) Note that audit and other reports documents made available to tenants through the Service Assurance section of the SCC are covered by Microsoft non-disclosure.
21 June 1 (Introduction) Rewritten note about customizing the App Launcher to take account of coverage of custom tiles and other methods in Chapter 5.
21 June 5 (Managing Office 365) Expanded coverage of custom tiles and the other methods available to introduce Apps to the My Apps options for users and thereafter to be pinned to the App Launcher.
20 June 4 (Migrating to Office 365) Rewritten section about checking calendar delegates.
20 June 5 (Managing Office 365) New Figure 5-4 inserted to reflect new UI for the Office 365 Admin app (on iOS).
20 June 10 (Planner) Add note that you can assign a task to a user by dragging icon onto the task.
20 June 13 (Hybrid recipients) New section “The New-RemoteMailbox cmdlet and the ExchangeGUID”
20 June 14 (Mail flow) Updated anti-spam and anti-malware sections to reflect options now available in the Security & Compliance Center
18 June 5 (Managing Office 365) Describe the meaning of the warning status returned by the Get-MsolAccountSku cmdlet.
18 June 9 (Office 365 Groups) Expanded section on Mobile Office 365 Groups following availability of updated mobile apps
17 June 8 (Mail-enabled recipients) Note about deciding whether to use shared mailboxes and Office 365 Groups.
17 June 20 (IRM) Fixed incorrect information about how to find the link to manage IRM in the new Office 365 Admin Center,
17 June 23 (Doing more) Note that an individual sway can have up to ten co-authors.
16 June 14 (Mail Flow) Note that message hygiene features now show up in the Security Policies section of the Security and Compliance Center. Also fixed a weird Word formatting problem that prevented the chapter heading showing up properly in the PDF.
16 June 18 (Security and Compliance) Describe the message hygiene options that are now available under Security Policies.
16 June 19 (Reporting and Auditing) Include fact that Advanced Office 365 Security makes up to six months of tenant data available.
16 June 23 (Doing more) Emphasizing point about Office 365 Video that a restriction (being fixed) limits channels to 5,000 videos. When fully deployed, the fix allows up to 20,000 videos per channel.
15 June 9 (Office 365 Groups) Outlook 2016 (build 16.0.6741.2048) introduced some new options into the ribbon, including the “Browse Groups” option, which delivers the same functionality as “Discover” Groups in OWA. Other minor updates, including stressing the point that using a group to build out the membership of a new group is a one-time operation.
15 June 12 (Addressing) Office 365 Groups don’t support the WindowsEmailAddress property, but they do support PrimarySmtpAddress.
15 June 18 (Security and Compliance) New Audited Controls option added to the Service Assurance menu of the dashboard. Also, added note that inactive mailboxes are not currently supported by content searches.
15 June 19 (Reporting and Auditing) Added note that the Azure Active Directory Premium license is required for some interesting passport events reports.
14 June 8 (Mail-enabled recipients) Updated and clarified example of using the Get-MailboxPermission cmdlet to retrieve the permissions that exist on a shared mailbox. Added some code examples showing how to retrieve permissions.
14-June 23 (Doing more) Maximum file size for video uploads to Sway specified
13 June 5 (Managing Office 365) Additional clarification and expanded advice about how to manage Office 365 licenses with PowerShell.
13 June 9 (Office 365 Groups) Figure 9-4 refreshed to show new UI for group document libraries including link to conversations in top right-hand corner.
13 June 9 (Office 365 Groups) Addition of text covering the Usage Guidelines and Classification List settings that can be set in the AAD policy governing the creation of new Office 365 Groups.
13 June 15 (Clients) Clarification about Outlook releases following reader feedback.
13 June Introduction Fixed formatting problem that caused the Legal Bits not to be displayed in the EPUB version.
13 June 10 (Planner) Completed updating of all text to reflect change of official name to “Microsoft Planner”. Also updated text of section about using PowerShell to manage Planner licenses.
9 June 5 (Managing Office 365) Rewrote Custom Help section to reflect new UI now available in the Office 365 Admin Center. Figures updated for new UI.
9 June 15 (Clients) New Email Apps section available when editing user properties in the Office 365 Admin Center allows email protocols to be enabled and disabled. New figure inserted.
9 June 22 (Delve) Beta version of Delve UWP app available in Windows app store.  Section renamed from “Mobile Delve” to “Other Delve apps” and new text about UMP app and screen shot inserted.
6 June 9 (Office 365 Groups) Addition of new section to explain how to use the AAD policy to govern how users can create new Office 365 Groups together with the knock-on changes to text about applications that can create Office 365 Groups. Subsequent update of text (June 9) when clarifications became available from Microsoft
8 June 20 (IRM) Expansion of details about what Exchange Online features do not work when BYOK is used with AAD RMS.
8 June 2 (Moving to the Cloud) Update of reference in Table 2-1 about Exchange Online and BYOK to point to Chapter 20
8-June 21 (Data Loss Prevention) Minor typos updated after technical edit pass.
7 June 9 (Office 365 Groups) Addition of section covering the Compliance Features available in Office 365 that work for Office 365 Groups.
6-June 9 (Office 365 Groups) Modification of text covering how to use the “old” OWA Mailbox Policy to govern user creation of new groups.
6 June 10 (Planner) General availability of Microsoft Planner announced and addition of section explaining how to assign licenses for Planner to user accounts and how to use PowerShell to disable Planner if required.

 

Posted in Cloud, Delve, Delve Analytics, Exchange Online, Office 365, Office 365 Groups | Tagged , , , , , , , | 9 Comments

Controlling the creation of Office 365 Groups using an Azure Active Directory policy


This text is an extract from Chapter 9 from the eBook “Office 365 for IT Pros”. This is an example of how we incorporate new events quickly into the publishing process and make new content available to readers. In this case, the General Availability of Office 365 Planner (announced by Microsoft on June 6 and covered in Chapter 10) served as a catalyst for the change in how policies control the creation of Office 365 Groups. We were able to test, assess, and document within a day and release new files to customers of ExchangeServerPro.com. For more information about Office 365 for IT Pros, see  ExchangeServerPro.com (for PDF and EPUB versions and some bonus material) or Amazon (for the Kindle version). 

Implementing a policy to control the creation of new Office 365 Groups

In November 2014, OWA was the first client to support Office 365 Groups. It was therefore logical that the developers chose to add a new setting to OWA mailbox policies to limit the creation of new groups. When a user attempts to create a new group, the setting (GroupCreationEnabled) contained in the OWA mailbox policy assigned to the user’s mailbox is checked. If the setting is $True, creation is allowed. Conversely, if the setting is $False, creation is blocked. Remember that a tenant can have several OWA mailbox policies active at any time, so it is quite normal to have an OWA mailbox policy that allows all options, including group creation, and others that are more restricted. OWA mailbox policies are applied to mailboxes by editing their properties through the EAC or by running the Set-CASMailbox cmdlet.

The downside of using an OWA mailbox policy is that it is a method specific to Exchange Online, where it is used to control the options available to users in the OWA client. As time went by and integrations with Office 365 Groups appeared that had no relationship with Exchange, the fact that OWA mailbox policies exist was ignored and any user was able to create new groups through these integrations. This is true for Power BI, Dynamics CRM, and Office 365 Planner, and when new groups are created with PowerShell.

Clearly, a new answer was required. The General Availability of Office 365 Planner on June 6, 2016 provided the opportunity to change the control mechanism to a policy stored in Azure Active Directory. The advantage of this approach is that Azure Active Directory provides a central point that all Office 365 applications can check. After a suitable policy is created, control over the creation of new Office 365 Groups is consistent everywhere. That is, once applications have been upgraded to use the new approach.

Follow these steps to create and implement a suitable Azure Active Directory policy to control group creation.

Create a group containing the set of authorized users: Azure Active Directory needs to be provided with a set of users who are allowed to create new Office 365 Groups. To define the set, you create a new group using the Office 365 Admin Center, PowerShell, or the Azure Active Directory console. The group can be a distribution group or an Office 365 Group.

Add the set of authorized users to the new group: You can add as many or as few users as you want. Because Office 365 Groups only exist in the cloud, the users who create Office 365 Groups should have cloud accounts. You can’t add a group to this group as only individual accounts are accepted.  Users who hold certain administration roles for the tenant do not have to be added to the set of authorized users as the role automatically allows them to create new Office 365 Groups. These roles are:

  • Company Administrator
  • User Account Administrator
  • Mailbox Administrator
  • Partner Tier1 Support
  • Partner Tier2 Support
  • Directory Writers

Prepare to edit the Azure Active Directory policy: The policy that controls group creation is also referred to as a directory settings object. As the default mode of operation allows any user to create a new Office 365 Group, the intention behind the new policy is to disable the ability of users to create groups by limiting creation to a set of users defined in a specific group. Because no UI exists for this purpose, you have to create the policy and populate its settings using PowerShell. Version 1.1.117.0 or later of the Microsoft Azure Active Directory Module for PowerShell (or later) contains the required cmdlets. As per the release history, this is a preview version of the module. To check what version you have, run the following command:

[PS] C:\> (Get-Item C:\Windows\System32\WindowsPowerShell\v1.0\Modules\MSOnline\ Microsoft.Online.Administration.Automation.PSModule.dll).VersionInfo.FileVersion

Next, you need to retrieve the object identifier (ObjectID) for the group that contains the set of authorized users. The PowerShell module for Azure Active Directory uses GUIDs to identify directory objects instead of display names. You can run the Get-MsolGroup cmdlet to access the object identifier for the group, but it’s easier to retrieve the information using the Azure Active Directory console to view the properties of the group (see screenshot). The object identifier is the last field shown for the group properties. Note the Copy icon to the right of the object identifier. Click this to copy the value of the object identifier to your clipboard.

PSCreateGroup

Viewing the Object Id for an Azure AD group

Use PowerShell to update the Azure Active Directory policy: Open a PowerShell session and execute the commands shown below. The commands identify the template that you want to use to create the new directory settings object that will govern group creation for the tenant, and then identify the group containing the set of users who are allowed to create new Office 365 Groups. The object identifier for the template you’re updating is consistent across all tenants. You can see that the object identifier supplied to update the template is the one copied from the group properties as shown in the screen shot.

[PS] C:\> Connect-MsolService
[PS] C:\> $Policy = Get-MsolSettingTemplate –TemplateId 62375ab9-6b52-47ed-826b-58e47e0e304b
[PS] C:\> $Setting = $Policy.CreateSettingsObject()
[PS] C:\> $Setting[“EnableGroupCreation”] = “false”
[PS] C:\> $Setting[“GroupCreationAllowedGroupId”] = "a3c13e4d-7083-4448-9224-287f10f23e10"
[PS] C:\> New-MsolSettings –SettingsObject $Setting

Once the commands complete, a new directory settings object exists that contains the values needed to control group creation. Any application that can access Azure Active Directory is able to check the settings and take the appropriate action to allow or deny a user the option to create a new Office 365 Group. To verify that the change is effective, run the following command:

[PS] C:\> Get-MsolAllSettings | ForEach Values

Name                        Value
----                        -----
GroupCreationAllowedGroupId A3c13e4d-7083-4448-9224-287f10f23e10 AllowToAddGuests True
UsageGuidelinesUrl
ClassificationList
EnableGroupCreation         False

Alternatively, you can use the Microsoft Graph Explorer to check the settings. Log in using your tenant account and enter https://graph.microsoft.com/beta/settings into the navigation bar and “beta” into the drop-down option list on the right-hand side. You should then see a set of settings data returned, including the values for the Object Id of the group containing the set of users who are allowed to create new Office 365 Groups and the setting that blocks general creation.

{

“name” : “GroupCreationAllowedGroupId”

“value”: “a3c13e4d-7083-4448-9224-287f10f23e10”

}

{

“name” : “EnabledGroupCreation”

“value”: “false”

}

Test that the new policy works: A user who is included in the authorized user group should be able to create new Office 365 Groups from the integrated applications (Planner, Dynamics CRM, and Power BI), and the Outlook Groups mobile app. A user who is not included should see an error message if they attempt to create a new group (something like “The group couldn’t be created. Your admin hasn’t given you permission to create a new group”).

It will take a little time for all of the applications and clients to fully support the new method and provide the necessary UI and that time will differ from tenant to tenant depending on the release cadence they follow. In particular, the MSI version of the Outlook 2016 desktop client will take time to be updated and then deployed to client desktops. However, the old OWA mailbox policy method continues to work for OWA and Outlook until superseded by the new method.

Follow Tony @12Knocksinna

Posted in Cloud, Office 365, Office 365 Groups, Uncategorized | Tagged , , , , | 10 Comments

Office 365 Advanced Security Management


This text is an extract from Chapter 19 of the eBook “Office 365 for IT Pros”. We’re commonly asked at what level the content of the book is pitched and how up to date it is. Well, this topic was announced by Microsoft on June 1 and you can judge the level for yourself. For more information about Office 365 for IT Pros, see  ExchangeServerPro.com (for PDF and EPUB versions and some bonus material) or Amazon (for the Kindle version).

Advanced Security Management

The Advanced Security Management application is included in the E5 enterprise plan and also available as an $3/month add-on for the other enterprise plans. Every user in the tenant needs to be licensed for Advanced Security Management as it is not possible to exclude the audit data for individual users from the anomaly detection and analysis.

The current implementation of Advanced Security Management is part of a long-term plan to provide Office 365 customers with much better oversight about what’s happening in their tenant based on the audit data that is accumulated in the Office 365 unified audit data mart, with the major advantage of the approach being that no agents or other software needs to be deployed to support the gathering and analysis of the data to detect the threats that might lie in the anomalies that are picked up. Analyzing the audit data also reveals how the actions taken by individual users might compromise the security of the organization through suspicious behavior, such as someone downloading all of the documents from a library containing confidential information within a short period. Other indications are taken into account, such as suspicious IP addresses that might originate from anonymous proxies or known botnets.

Advanced Security Management allows administrators to create tenant-specific policies to fire alerts when specific events happen or when a particular pattern of actions occur. For instance, you could create a policy that will alert administrators by email or SMS whenever certain conditions occur. Microsoft provides a preconfigured “General anomaly detection” policy to get the ball rolling. This policy covers common conditions that should cause suspicion, such as a user logging in from two places that are widely separated in distance within a short period. Other anomaly detection policies can be added to highlight specific activities that are of concern to the organization. For example, a policy could be created to look for attempted log-ins from IP addresses outside the corporate IP range. Policies can be tailored to turn off or on different risk factors or to increase sensitivity to a risk.

AS 1

Alerts show up in the Advanced Security Management Console

The screen shot above shows how a set of alerts appear in the Office 365 Advanced Security Management console. In this case, a set of alerts have been signaled because Advanced Security was recently enabled for the tenant. When this happens, Advanced Security examines the current state of the tenant to establish a baseline and to report any events that it believes should be brought to the attention of an administrator. The fact that someone accesses an application, like SharePoint Online or OneDrive for Business, from a location for the first time is an example of a built-in anomaly alert that helps the system to set a baseline. The first alert shows that Paul Cunningham accessed SharePoint from Australia (AU). If this is expected because Paul always accesses Office 365 from Australia, the administrator can resolve the alert (to mark it done) and the alert will no longer appear because Advanced Security knows that this is a normal condition. On the other hand, if Paul’s account is used to access SharePoint Online from Egypt when he is known to be sunning himself in his back garden in Brisbane, then we might have a problem. When the security administrator resolves an alert, they can enter a comment to explain why the condition is satisfactory and deemed to be resolved.

Reviewing Office 365 Advanced Security Alerts

If more information is needed to understand the pattern behind a user’s behavior or another aspect of an alert, such as the IP address, the administrator can click the item to have Advanced Security Management reveal what it has recorded in its Activity Log. For example, all events logged for Paul Cunningham are shown if his account name is clicked.

Each alert is rated a high, medium, or low risk. The risk level is determined using behavioral analytics to compare normal user interaction with Office 365 against the information contained in the audit data. The analytics are based on Microsoft’s collected knowledge about the threats that exist and their origin gathered from across Office 365 and other cloud services. Assigning a risk value allows an administrator to filter for high risk alerts and prioritize their resolution.

Another example of an alert is when an account is detected to have elevated permissions (a “New admin user” alert). Again, if the permissions were assigned purposely, the alert can be resolved and Advanced Security knows that it does not have to signal the issue again. However, it could be the case that someone has been assigned permissions in error or that they hold permissions for too long, in which case the resolution is different and might require the account to be suspended or to have its permissions adjusted. User accounts can also be suspended as an action contained in a policy to ensure that action is taken to protect the organization without requiring an administrator to do something manually. Suspended users show up in Office 365 as blocked users. If this turns out to be the wrong thing to do, you can reverse the suspension from Advanced Security Management or the Office 365 Admin Center.

It’s possible that an alert highlights an event that is uninteresting or invalid. In these instances, you can dismiss the alert or mark it as a false positive. These actions are recorded in the Activity Log and the fact that the user’s location or their admin status is deemed to be valid will be taken into account by Advanced Security Management when it processes audit and other data to detect anomalies and suspicious activity in the future.

Filters are available to focus in on one or more of the Office 365 applications or to look for selected users. The latter filter is valuable when you might be concerned about the activities of a particular individual. You can also search for high, medium, or low severity alerts or for alerts that have been previously dismissed or resolved. You can also filter by category (access control, compliance, configuration control, privileged accounts, sharing control, and threat detection). The filters can be combined together to focus in on certain actions, meaning that even a very large volume of alerts can be quickly refined to produce a set of alerts that need to be examined. You can also export alerts to a CSV file if required.

Advanced Security Management is accessed through the Alerts section of the Security and Compliance Center where the Manage Advanced Alerts option connects to Microsoft Cloud App Security, a platform designed to analyze very large amounts of information relating to security events.  Cloud App Security has no dependency on Office 365 and is available for purchase as a standalone product. The version used with Office 365 only handles Office 365 data; the standalone version is capable of handling data extracted from many other cloud applications.

When a tenant opts-in to use Office 365 Advanced Security, a link is created between the Office 365 tenant and an equivalent tenant automatically created within Cloud App Security. The link allows audit data to be extracted from Office 365 and analyzed by the Cloud App Security analytics engine, which detects suspicious activity and other potential problems. It takes about a week after a tenant is enabled before a satisfactory model is created of its normal activity and build a baseline that suspected anomalies can be measured against.

Audit entries extracted from Office 365 can be examined in the Activity Log along with other logged items, such as those recorded when an administrator resolves or dismisses an alert. Again, a range of filters are available to reduce the number of log entries down to a manageable amount. In the example shown below, the filters have been used to extract events relating to document check-outs by users based in Bulgaria in a certain period. Note the option in the top right-hand corner of the screen to create a new policy based on search criteria, meaning that you can easily create a new policy to create alerts if similar events occur in the future.

AS Log

Filtering Audit events

One issue for non-U.S. customers is that Cloud App Security is currently based on an Azure data store that runs in a U.S. datacenter. However, only audit data and information about tenant users and groups is moved to the Azure data store and personal information belonging to tenant users remains within Office 365. Microsoft plans to extend Cloud App Security so that its data is stored in other datacenter regions in the future. When this happens, Cloud App Security data for a tenant will be stored in the same region as Office 365.

In some respects, apart from the analytics used by Advanced Security Management to pick up suspicious activity by correlating events, the technology is not rocket science. You could argue that a skilled administrator who knows what is happening in their tenant is likely to be able to detect and resolve the same kind of issues that Advanced Security highlights. However, an application like Advanced Security scores through its ability to handle massive quantities of information of the type generated by audit events and to reduce the mass down to what’s important. A human can do this too, but will struggle with:

  • The volume of data to process (especially as the environment scales).
  • The time required to recognize complex suspicious audit events and to learn the characteristics that mark new threats
  • The need to be consistent in how events are treated.

It’s also likely that the human administrator will forget that some events have happened (or not) in the past, so when something happens, they have to consider the event on its merits. Computers are better at remembering things, so Advanced Security Management quickly recognizes when an event is rare (and therefore potentially out of the norm) or normal.

In addition, the machine learning that lies behind analytics is much faster at correlating events to detect suspicious activity. Once software learns what it should be looking for, it generally produces more consistent results than a human can, 24 hours a day, 365 days a year, which is why applying technology to automate the collection and validation of information drawn from multiple sources is a good solution to understanding the kind of threat introduced by how individuals behave.

Follow Tony @12Knocksinna

Posted in Cloud, Office 365, Uncategorized | Tagged , , , , , | Leave a comment

Introducing Office 365 for IT Pros – third edition – now available


office-365-for-it-pros-cover-2016-june-2

The writing team is delighted to announce the immediate availability of our new eBook “Office 365 for IT Pros – Third Edition” at ExchangeServerPro.com. The PDF (for PCs) and EPUB for many eReaders, including the iPad, are available now and the Amazon Kindle version is available for pre-order, with a release date of June 12 lined up.

Nineteen months ago, Paul Cunningham and I started work on the idea of creating a book that would help Exchange on-premises administrators move over to Office 365. After roping in Van Hybrid as a co-author and enlisting the services of Jeff Guillet as the technical editor, the first edition was released at the Microsoft Ignite conference in May 2015.

The first edition, which we named “Office 365 for Exchange Professionals”, was flawed and imperfect, as all first efforts are, but it was a fantastic learning experience for us in terms of how to put together and publish a book. We wanted to do something different, to have a living book that took advantage of the power of the Internet to keep pace with the changes occurring inside Office 365. This led us to the concept of pushing out regular updates for the book, which is what we now do. Sometimes updates occur every few days, sometimes it’s every few weeks. It all depends on what’s happening inside Office 365 and if we find mistakes (editorial, formatting, or grammatical) that we need to fix.

When we began work, we always knew that we would release new editions when we considered that we had enough new material to warrant such a release. The second edition appeared in September 2015. This was possibly too soon after the first edition but we wanted to correct some of the flaws that were apparent in the first edition. Anyway, the version of the second edition that is currently available is considerably different to what was released in September because we have made so many changes over the intervening period. That’s one of the joys of e-publishing: if you’re unhappy with a book, you can keep on working on it until the book is in a shape that makes you happier.

Over the last year, we also brought the book to Amazon to make it available to Kindle users and have looked at the feasibility of printed copies. Formatting for Kindle proved to be one of those “interesting” challenges that are supposed to build character. We’ve spent a lot of time during this release cycle to improve the formatting for both EPUB and Kindle, particularly around how PowerShell examples are displayed, and although these are better, we know that more work is needed in this area.

Kindle isn’t profitable when you look at the number of hours that are invested into preparing a large technical book for publication through that channel compared to the net revenue after Amazon extracts its 70% fee, but people do like having books on their Kindle devices and we’re happy to facilitate that choice.

Printing books, which we did with the support of Microsoft for the first edition, is an expensive and time-consuming business. We’re still looking at whether this is a good road to go down. The biggest concern is that printing delivers a point-in-time version of the book that we can’t update. This is fine when technology doesn’t change all that often, which is why printed books worked so well in the past when a new version of an on-premises product like Exchange or SharePoint appeared once every three years. However, when you’re trying to cover a topic like Office 365, a service that introduced 450 changes in the year to August 2015, doing so in a print format is an interesting problem to contemplate.

As proof of the issue, just look at all of the print format Office 365 books that are available today. We’ve learned from our experience that any material that was published more than a year ago is now very outdated and anything past that point is possibly misleading and invalid. That’s a real problem for us. But on the other hand, when we surveyed readers, we heard that print was still the second most popular medium for technical books and that people would like a printed version. We’ll keep an eye on the evolving methods that are available for print-on-demand distribution to see whether we can do something useful in this space.

We’ve been working on the third edition since February. This is our biggest release yet and because of a massive change in scope and the amount of new material covering new topics, we’re also changing the title of the book to reflect that content. Instead of “Office 365 for Exchange Professionals”,  which we used for the first and second editions, the third edition is called “Office 365 for IT Pros”. The new title reflects the real breadth of the book and we think it’s the right one to use going forward.

Office 365 for IT Pros extends to over 800 pages spanning 399,000 words in 24 chapters, and includes 688 practical examples of PowerShell being used to interact with different Office 365 workloads. We’re reducing the price of the book by $5 to $39.95. Early-bird discounts are available on ExchangeServerPro.com until mid-June.

Those who notice these things might note that we reduced the margins on the pages to make them more like U.S. trade-size books. If we ever decide to print copies, this change had the bonus effect of reducing the number of pages required. We also removed a heap of graphics that we didn’t think added as much value as we wanted. Overall, the book is about 10% longer but we estimate that we added about 250 pages of new material. In addition, every existing page was checked by multiple people to ensure that its content reflects what we see today in Office 365 rather than what we might have observed in late 2014 when we started to first write.

Major work areas for the Office 365 for IT Pros team included:

  1. Adding coverage of new Office 365 applications such as Office 365 Planner, Delve Analytics, Advanced eDiscovery (Equivio Zoom), and Advanced Security Management
  2. Revising the text covering feature areas that have received major updates over the last six months: Admin, Office 365 Groups, HCW, and the Security and Compliance Center.
  3. Expanding the book’s focus to encompass all of Office 365 rather than a prime focus on Exchange Online. Exchange remains important and there’s lots of content covering how it works in the book, but the balance is better.
  4. Revising the structure and flow of the book to bring common material together (like identities and authentication – now covered in chapter 3).
  5. Removing of material that is of lower interest (site mailboxes), takes up lots of space (migration steps and history of Exchange), or is redundant. The material that we consider still valuable is available to customers through 100+ pages of downloadable bonus files.

The change in focus to cover all of Office 365 means that we include a lot more material on SharePoint Online and OneDrive for Business, both of which are great areas for companies to investigate when they move to the cloud. SharePoint Online is particularly important because of its foundational role in applications such as Office 365 Video. The topics covered in the book are:

  • Exchange Online (probably 50%)
  • SharePoint Online
  • OneDrive for Business
  • Office 365 Video
  • Office 365 Groups
  • Office 365 Planner
  • Advanced Security Management
  • Delve and Delve Analytics
  • Advanced eDiscovery and what Microsoft is doing to make eDiscovery happen for all Office 365 sources
  • Yammer (some)
  • Even Sway! – and discovered some interesting nuggets, such as sharing and data at rest location

We are proud of the in-depth coverage of areas like Office 365 Groups, Planner, Clutter, Office 365 Video, Delve Analytics, and Exchange hybrid connectivity – it’s at a level that we believe is simply unavailable in such a comprehensive form elsewhere.

We received great help and assistance from many people at Microsoft who work on Office 365 to parse out what really happens behind the scenes of features like Delve Analytics. In addition, we are grateful for the help and advice that we had from many of our fellow MVPs. We also acknowledge with gratitude the contribution of our technical editors, Jeff Guillet and Vasil Michev, who played a huge role in refining and improving the text.

Our biggest issue now is curating the mass of information we have assembled to ensure that it remains accurate, up-to-date, and interesting. That’s a challenge we accept with relish. We also need to continue to work hard to expand the non-Exchange content to enable readers to more productive and effective with all of Office 365.

We will continue to update Office 365 for IT Pros to keep track of updates released by Microsoft. And then thoughts will turn to what the next edition might include…

Thanks for all your support to date. We hope you enjoy the book. And if you’d like to listen to Paul and I discussing its creation, why not download the podcast on the topic.

Tony, Paul, and Michael

Follow Tony @12Knocksinna

Posted in Cloud, Delve, Delve Analytics, Exchange Online, Office 365, Office 365 Groups, SharePoint Online | Tagged , , , , , , , , , , , , | 2 Comments

Office 365 Exposed Podcast #3


As the gentle readers of my blog might remember, the esteemed Paul Robichaux and I often tape a podcast when we’re together. Unlike other podcasts about Exchange and/or Office 365, we try to take a strategic look rather than diving down into the weeds. Although we’re not always successful, we have a good time chatting about what’s going on. Paul has posted the latest episode on his site – you can get it there or download the podcast from iTunes.

  • The topics include the horrible mess that Microsoft Learning is making of recertification for messaging MCSEs and why “YouTube certification” isn’t worth much (also discussed here)
  • How technologists can stay ahead of the curve in a world when things change at an increasing rate.
  • What’s likely to happen at the Microsoft Ignite conference in Atlanta next September and why the “Anti Kool-Aid” conference (aka IT/DEV Connections) offers value of a different type. I’m looking forward to IT/DEV Connections, which takes place in the ARIA Hotel in Las Vegas in October, because it attracts a great crowd, including many MVPs and even some of the more famous individuals from the world of Exchange.
  • The need for ISVs to react as the on-premises market shrinks and Microsoft takes more of the available space in the cloud.

In any case, enjoy! And if you don’t, well…

Most of my time in the last few weeks has been spent preparing for the publication of the upcoming “Office 365 for IT Pros” book. We’re making excellent progress and the book is now listed for pre-order on Amazon. Expect an announcement soon about the availability of the PDF and EPUB versions from ExchangeServerPro.com.

O365ITProsKindle

Office 365 for IT Pros – now available for pre-order for Kindle

In any case, because we’re writing about Office 365, I have been pretty hard-nosed about using Office 365 to support the writing effort. Naturally, all of the text is created using Word 2016 and 2013 before it is converted to PDF, EPUB, and MOBI (for Kindle) and we store the files in an Office 365 group document library (SharePoint Online).

The writing team is distributed across Ireland, Australia, and Belgium and our technical editors are in the U.S. and Bulgaria, so we have a pretty good spread. This shouldn’t be an issue because Microsoft has installed a network of local network access points for clients to connect to Office 365. Once connected, traffic is routed across Microsoft’s dark-fiber datacenter backbone, so it doesn’t really matter where in the world someone happens to be.

The network is great but the tools have flaws. Two in particular have been causing me some grief. First, the change that Microsoft made in Excel 2016 as to how worksheets that are stored in SharePoint Online document libraries are opened. The worksheets are now opened in read-only mode and the theory is that you can click the button to open the worksheet in write mode. If this is what happened all would be well and I wouldn’t complain, but it doesn’t. At least not about 40% of the time. When this happens I close the worksheet and open it again and invariably, but not always, it can be opened for writes. Office 2016 has been out for nine months and I’m using the up-to-date click-to-run version. There’s no excuse for this kind of problem to persist so long.

Until of course you find another even worse problem, which is the bastard child from IT hell called the OneDrive for Business sync client (the old and horrible version). OneDrive for Business has two sync clients. The old one is built on the now-ancient foundations of Groove, a product I attempted to deploy at Compaq in 2001. It was a network pig then and we dropped it after trying to make Groove work for a year or so. Even Ray Ozzie’s words of reassurance failed us.

A decade-and-a-half later, Groove.exe is no better. On the other hand, the new sync client, which is used for both the consumer and business versions of OneDrive, is pretty good and appears to be reliable. At least, I do not have to fix, repair, swear at, moan about, or otherwise castigate the old-and-horrible sync client after it fails once again. I am patient (normally), but the baffling array of faults that this software has exhibited for years makes me wonder why Microsoft hasn’t a) put Groove.exe out of its misery and b) fixed the new sync client so that it can handle SharePoint Online document libraries. Apparently that functionality is coming “before the end of 2016”. It can’t come soon enough.

Finally, I see that Paul Cunningham has written an in-depth review of QUADROtech PST FlightDeck, a tool to help find, process, and migrate those annoying PSTs and get the data across to Office 365 where the data is safe, compliant, and secure. Full disclosure: I am an external board member for QUADROtech – even so, I think this review contains a number of points that anyone looking to take on a PST migration should build into their project.

Speaking of which, I must run an catch the flight to Zurich to go and attend a board meeting…

Follow Tony @12Knocksinna

Posted in Cloud, Email, Office 365, Technology | Tagged , , , , , , , | Leave a comment

Delve finds private Office 365 Groups and other ramblings


As the weekend draws thankfully nearer, some thoughts about recent developments that have come into my idle mind that need to be shared with the world.

First, a question arose about the way that Microsoft’s Outlook for iOS and Android clients still store user data on Amazon Web Services. People don’t like this with good reason because the data is not covered by the steps Microsoft takes to protect data on their own cloud platforms. This isn’t to say that Amazon does anything untoward with the data; it’s simply a matter that Microsoft can’t make guarantees about how Amazon protects user data.

The fact that this data resides on Amazon is a lingering artifact of the way that Acompli, the company who originally developed the clients, processed information. Microsoft is all too aware of the need to change and really wants to get the data moved over to Azure. When I spoke to Javier Soltero, the newly-installed GM for Outlook, in January, his take was that the switch would happen in “early 2016”. Clearly that hasn’t happened and data continues to be processed on Amazon to construct the “focused Inbox” loved by the 30-odd million users who have downloaded the Outlook apps (presumably they use the apps too). Essentially what happens here is that the data is fetched (using ActiveSync) from user mailboxes, processed in a data store on Amazon Web Services, and then provided to clients.

There’s no doubt that the data should be on Azure, if only to allow Microsoft to be able to provide an end-to-end guarantee that data is being protected from mailbox to client and back again. However, it does take time and care to make a fundamental switch like this and it’s likely that some technical hiccups have occurred along the way. I’d prefer that the job is done right than being rushed through to make some arbitrary date. Stay tuned, this change is coming. Soon.

Another question that came my way asked about the possibility of using the venerable IMAP4 protocol to access Office 365 Groups. I’m afraid that this query deserved a blunt “No” – and with good reason. IMAP4 is a mail access protocol, conceived at a time when email servers were rudimentary and email was barely functional. Although the protocol has been tweaked and enhanced over its 30-plus year history, it is now so archaic and obsolete that it really should be consigned to the dustbin. I know some people care very much about IMAP4 and like the clients that use it, but much better and more powerful protocols exist to allow people to access Exchange and Office 365. Exchange Web Services is one, ActiveSync is another. And the browser interface (Outlook Web App) is now so functional that it is more than sufficient for most situations. Enjoy yourself with IMAP4 if that’s your personal choice, but don’t expect to be able to do anything than just plain email.

Speaking of Office 365 Groups, it is good to see that Microsoft has eliminated the problem that caused documents in private groups to be invisible to the Search Foundation, which is the technology used to index information managed by both Exchange and SharePoint. These documents are now visible and can be included in content searches (essential for compliance) and show up in Delve (see below), all of which makes private Office 365 Groups much more valuable all round. It also removes a deployment blocker for some companies who were concerned that information was hidden in these libraries. To be clear, my tenant is configured for First Release and you might not see this functionality yet if your tenant uses Standard Release.

DelveDocuments

Delve exposes documents stored in the document libraries of private Office 365 Groups

The sites used to host the document libraries for Office 365 Groups have had quite a history. Each site uses a hidden site collection. The reason why they are hidden is to stop people using regular SharePoint management tools against the sites as this might impact the special links that Office 365 Groups use to tie together components drawn from different workloads, specifically access to the SharePoint Online resources. Recently, Microsoft dropped the old (and restricted) UI for group document libraries and upgraded it by adopting the UI used for “regular” sites. The upside of the change is that a lot more functionality was made available for group document libraries. The downside is that some parts of SharePoint (like access control) are now revealed in a way that might tempt people to mess where they shouldn’t. The golden rule for these sites is to leave well alone. If you want to customize a site to meet some specific requirements, create a regular team site and have your way. Don’t complain to Microsoft if a customization you make to a group document library has some unforeseen consequences. Always practice safe SharePointing…

Another good thing that has come about through that recent change is that the sites used for Office 365 Groups are now treated like any other SharePoint Online site within a tenant.As shown below, two Office 365 Groups are listed alongside a team site. You really wouldn’t know the difference.

SPOSites

SharePoint Online sites used for the document libraries belong to Office 365 Groups are listed alongside normal sites

To close, the team writing the “Office 365 for IT Pros” ebook are closing in on the final text. We’re busily processing the results of some very insightful technical edits and reviews by some of our fellow MVPs, all of which are helping us to improve the quality of the information presented in the book. It’s always amazing how text that makes sense to an author can confuse others, so it’s great to have people read over what we have written so that we can clarify and expand where required. We’re also terrifically pleased with some of the advice and guidance we have received from some of the Office 365 engineering teams where developers have taken the time to explain in great detail just what they are trying to achieve with some of the newer functionality that is now appearing.

The new book is available for pre-order on Amazon. If all goes well, we should be able to release it to members of the ExchangeServerPro.com site on June 1 and have general availability a week thereafter. At least, that’s the plan.

Follow Tony @12Knocksinna

Posted in Cloud, Delve, Office 365, Uncategorized | Tagged , , , , , , , | Leave a comment

Chasing down mailbox delegate access in Exchange Online


A recent question from a reader focuses on the need to determine the last logon time for Exchange users. The organization is in the middle of moving to Exchange Online and some management reporting scripts that are used do not deliver the same results when run against Exchange Online mailboxes.

A quick discussion revealed that the script uses the Get-MailboxStatistics cmdlet to retrieve login information, specifically the LastLoggedOnUserAccount property. For instance, if we use the cmdlet to look at an Exchange Online mailbox, you might see something like this:

[PS] C:\> Get-MailboxStatistics –Identity Ben.Owens@Office365ExchangeBook.com | Format-Table *Log*

LastLoggedOnUserAccount LastLogoffTime LastLogonTime

----------------------- -------------- -------------

                                       10-Mar-16 5:39:54 PM

The LastLogonTime property reports the last time the mailbox was logged onto by a user and is available. The LastLoggedOnuserAccount property, which is used to report the name of the last account to connect to the mailbox is blank. In some instances, this information could be important because it’s not necessarily the case that the mailbox owner is the account that connects to the mailbox. Perhaps it was another account with full access permission.

Two problems are faced here. First, the ability of the Get-MailboxStatistics cmdlet to report the name of the account that logged on to a mailbox was deprecated in Exchange 2013. If you examine mailbox properties through the Exchange Administration Center (on-premises or Online), you’ll see that only the last logon time is reported.

Second, Office 365 operates a directory of record (Azure Active Directory) and workload-specific directories. The directory of record is the source of authority for account information while the workload directories hold information specific to a workload. Exchange Online does not have the same intimate relationship with the directory of record as exists on-premises where Active Directory is used for everything.

For example, Exchange Online obviously needs to hold information about mailboxes that are not necessarily required by every Office 365 account as some accounts don’t use Exchange. This information is held in EXODS (Exchange Online Directory Services). An EXODS instance is operated for each Exchange Online forest and multiple forests support the various Office 365 regions (U.S., EMEA, India, etc.). Similar arrangements exist for SharePoint Online (SPODS), Skype for Business (LYODS), and Yammer.

Synchronization routines are in place to keep Azure Active Directory and the workload directories aligned. Normally, synchronization is very fast and a change made to an attribute in a workload directory is updated in Azure Active Directory in a matter of seconds.

However, because Azure Active Directory is the directory of record, you have to retrieve information about user logons from it rather than using a cmdlet like Get-MailboxStatistics that operates exclusively against EXODS. Thus, we need to use the Search-UnifiedAuditLog cmdlet to interrogate the Azure Active Directory data held in the SIEM-like repository for audit information drawn from workloads across Office 365.

The unified auditing repository is the same data that is searched by the Office 365 Activity Report option in the Compliance Center. It is populated by feeds from multiple sources drawn from across the service, including Exchange mailbox and admin audit data. The idea is that the number of sources will be enhanced over time so that audit information from every Office 365 workload will be available through a common interface, which seems like a good thing.

Here’s an example to search the unified audit repository for logons by a specific user (you can pass several user identifiers separated by commas):

[PS] C:\> Search-UnifiedAuditLog -Operations PasswordLogonInitialAuthUsingPassword -StartDate 9-Mar-2016 -EndDate 10-Mar-2016 –UserIds Ben.Owens@Office365ExchangeBook.com | Format-Table UserIds, Operations, CreationDate

UserIds                             Operations                            CreationDate

-------                             ----------                            ------------

Ben.Owens@Office365ExchangeBook.com PasswordLogonInitialAuthUsingPassword 10-Mar-16 5:41:06 PM

Depending on when the data is imported from a feed, it can take up to 12 hours before data from a source appears in the repository. In some cases, you can get the data that you need sooner by executing searches against Exchange admin audit log or mailbox audit log data. However, the caveat here is that sometimes those searches don’t work as well as they should.

Audit events return a property called AuditData in JSON format. You can look at the raw data and pick things out but it’s often easier to use the ConvertFrom-JSON cmdlet to interpret the data. First capture the audit event you want to examine into a variable and then run it through the cmdlet. For example, this code finds some records, stuffs it into the $Audit variable, and uses the cmdlet to view the audit data of the sixth record in the set.

[PS] C:\> $Audit = Search-UnifiedAuditLog -Operations PasswordLogonInitialAuthUsingPassword -StartDate 9-Mar-2016 -EndDate 10-Mar-2016 –UserIds Ben.Owens@Office365ExchangeBook.com | Format-Table UserIds, Operations, CreationDate

[PS] C:\> ConvertFrom-JSon $Audit.AuditData[5]

The client field gives us a clue as to what application was involved. For instance, if you see “Outlook” here you know that an Outlook client has authenticated against the account. If “Exchange” is shown, it means that an ActiveSync client connected. However, these events record instances when clients were forced to go through the process of entering a password. If cached credentials are used, they won’t be recorded. We need to focus on audit events for a different operation. The MailboxLogin operation seems like a good choice:

[PS] C:\> Search-UnifiedAuditLog -Operations MailboxLogin -StartDate 9-Mar-2016 -EndDate 10-Mar-2016 –UserIds Tony.Redmond@Redmondassociates.org | Format-Table UserIds, Operations, CreationDate

By now you’ve realized the flaw in this explanation. No connection exists between the audit data and the mailbox logon data. We know that some account connected to a mailbox at a certain time. We can surmise that it might be the mailbox owner by checking the logon data from Azure Active Directory, especially if the user logged on to their account just before the connection was made to the mailbox. But we can’t prove that the mailbox owner was the account that connected to the mailbox.

All of this proves that you can’t take it for granted that scripts or other techniques that work well on-premises will transition flawlessly into the cloud. Office 365 is a completely different environment (in so many different ways) than any on-premises environment. Some work is probably required to review and, if necessary, to update your favorite scripts before they’ll work as well in the cloud.

The good news is that Microsoft’s approach to build a unified auditing repository for Office 365 encompassing all workloads is commendable and is likely to improve in terms of scope and capability over time. Isn’t progress wonderful?

Follow Tony @12Knocksinna

Posted in Cloud, Exchange, Exchange Online, Office 365 | Tagged , , , | 2 Comments