Microsoft-Azure

Last two weekends I went to SharePoint Saturday in Paris and Belgium. It is always great to meet other SharePoint and Office 365 consultants, customers and suppliers.

SPS Paris

The first weekend I went to Paris where I did not read my emails to carefully, so I was at the wrong venue. I was not the only one. It took some extra time to get to the new location. Arrived there I was just in time for the first session; this was a session about the secure score site from Microsoft. The URL of the Secure Score is http://securescore.office.com. Here you can log in with an administrator account and see what security settings you can do to make your tenant more secure. You need to be a Global Administrator, SharePoint Administrator, Exchange Administrator or Compliance Administrator to access it.

A year ago, I wrote a post about Azure AD conditional access, with the change to the new portal a lot has changed. This post will show what is changed since then and what is coming.

The biggest change in conditional access is that last year you had to configure this per application in the old portal, there was no reference in the new portal (current one) back then. Now you can create policies that apply to one or multiple applications or even tenant wide. There is now 1 logical location where you can manage these settings. This location is in the Azure Active Directory Blade under security.

This post was inspired by a Facebook group where there was a question what we could teach the others and since my expertise is about Office 365 and Azure and suggested that I could write about that, but it was to technical so they asked me to make teach a higher over topic. One of the topics is explaining the benefits of using the cloud. To do that I need to start what the cloud is.

This week I needed to create a demo environment for my presentation at SharePoint Saturday in the Netherlands and I Installed the latest version of Azure Active Directory Connect (1.1.524.0) and to my surprise it supported modern authentication when I connected to Azure Active Directory. I created an account where MFA was disabled to make the connection but that was not necessary to my surprise. See the screenshot below asking Azure Active Directory Connect for sign into my tenant.

This week I did a presentation at DIWUG about how to use Azure Automation in combination with Office 365

I told about the possibilities of Azure Automation, what you can do with it in general and then zoomed in on specific tasks within Office 365 like setting the useslocation of your users. When you need a Hybrid configuration and how you can use version control with your scripts.

[slideshare id=83741543&doc=20170518-watkanazureautomationbiedenvooroffice365klanten-171209194336]

Connecting to Exchange Online was only possible with an account that did not have MFA enabled because it only can handle basic authentication. This is an issue because Microsoft advises us to have accounts that can do administrative tasks to have MFA enabled. Now we must choose between an account that has no MFA and a possible security breach and an account that cannot connect to Exchange Online.

To solve this, we had an account that was disabled by default and when we had to do Exchange tasks we enabled it. This is a solution but not a great one.

Last week I found out that the account name that you use in Azure automation are case-sensitive. We found this after a co-worker was adding a credential to the credentials assets. I had used some capital letters to read the account name a bit better in our local AD and my co-worker just wrote them down with small letters. He came back to me asking if the password was correct because the credentials did not work. After some tries and digging we found out that the casing of the account was the issue.

This year of SharePoint Saturday’s started with the one in Munich last weekend. This time there was also a preconference session on Friday. The sessions on Friday and Saturday were held at the brand-new building of Microsoft Germany.

Friday session

This year they organized two preconference sessions. A developer one about Office Dev PnP and an IT Pro about SharePoint 2016. I went to the SharePoint 2016 session where they talked about all the aspects of SharePoint 20116. They started with the architecture and the differences between SharePoint 2013 and 2016. They also explained where the issues were and how to solve them. After the architecture session we went into the authentication options within SharePoint and the hybrid identity. Here we looked at the identity options within Office 365 and the options to get your on-premises users into the cloud. Also, the dependencies where discussed like ADFS on-premises and your local internet line is down. After the lunch break we had a session about PowerShell and the Office Dev PnP PowerShell module that is available for on-premises and Office 365. We ended the day with setting up Hybrid. Thomas did a complete hybrid setup in just 1 hour with some preparations that he did on forehand. The most important part of the hybrid setup of Office 365 is that your identities are available in Office 365. When you have, that part done and your SharePoint farm can talk to the internet you can run a simple wizard from the SharePoint Online admin portal to setup the hybrid farm. This wizard will setup:

Last week Microsoft announced the general availability of Managed Disk (https://azure.microsoft.com/en-us/blog/announcing-general-availability-of-managed-disks-and-larger-scale-sets/). Until now you always needed to manage you own storage for storing the VM disks. With this option you now have the option to create VM’s without caring about the underlying storage. Using managed disks is made very easy by just selecting Managed Disk while creating a new VM in the portal.

When you want to create a VM using PowerShell you just need to add configure type of storage while creating the OS Disk with this command “Set-AzureRmVMOSDisk”. See this page https://docs.microsoft.com/en-us/azure/virtual-machines/virtual-machines-windows-ps-create for the full manual.

In the last week of 2016 I was working on some issues that some users in certain groups were not synchronized to Azure AD. The users itself were in Azure AD but the group membership did not sync. The problem here was that the users were in another forest than the group.

At this customer, we have multiple forests with users from the different countries and they start to work together more and now we had some complaints that the users where not able to access resources while they placed them in the correct groups. The issue that we had was that the synchronization removed the users from the other forests from the group membership during the synchronization.