Monthly Archives: February 2016

Changes to Azure AD Connect Sync Scheduler

The latest builds of Azure AD Connect, beginning with (build 1.1.105.0 Feb 2016) no longer rely on the Task Scheduler for scheduling when the directory sync runs.

Also, the default interval has changed from 3 hours to 30 minutes.

What’s really interesting is that Microsoft is now communicating that the most frequent interval that synchronizations can occur is now 30 minutes. You can try setting it to a lower value but the ‘CurrentlyEffectiveSyncCyleInterval’ shows you that they are ignoring you and setting it at the ‘AllowedSyncCyleInterval’ value of 30 minutes (see screen shot).

image

There is also a new method for manually forcing a sync: If you need to manually run a cycle, then from PowerShell run Start-ADSyncSyncCycle -PolicyType Delta.  To force a full sync type Start-ADSyncSyncCycle -PolicyType Initial

The previous methods for forcing a sync were running the task scheduler or using DirectorySyncClientCmd.exe. In earlier versions it was using Start-OnlineCoexistenceSync. So depending on the version of Dirsync, there could be at least three different methods to force a sync. This blog article (here) by Rhoderick Milne [MSFT]  gives a good historical overview of the previous releases and methods of forcing a sync as it has changed a few times.

This does not apply to you unless you manually upgrade to the latest version or if you are a new customer and downloaded the latest version of Azure AD Connect.

The instructions and usage for the new scheduler are located (here).

I noticed that after running a full sync and several delta syncs, that the users in the portal show as ‘In the Cloud’ rather than the expected ‘Synced with Active Directory.’  I closed and re-opened my browser and then they showed the correct status of ‘Synced with Active Directory.’ So there appears to be a bug with the browser interface where it is caching the ‘Status’ column and not updating after a directory sync. Interesting! So if you encounter this, try closing and re-opening the browser.

Need help with your next Office 365 Project? We can help you deploy any or all of the 21 features Included in Office 365 for a flat rate per month.  Contact us at Hello@PatriotConsultingTech.com.

Crawl OneDrive Sites to report usage information

I just uploaded a PowerShell script to the Microsoft Technet ScriptCenter that provides reporting information on OneDrive usage, with a CSV output of each user’s usage.

report

The script can be downloaded from here: Crawl all OneDrive Folders

This is helpful because the two built-in reports available in the Office 365 Admin Portal do not provide details on per-usage usage. They provide high level aggregate data only.

image

Need help with your next Office 365 Project? We can help you deploy any or all of the 21 features Included in Office 365 for a flat rate per month.  Contact us at Hello@PatriotConsultingTech.com.

Office 365 Education “Domain in Use”

When it comes to planning an Office 365 migration, there is one gotcha that can be a surprise that is only found when signing up for a new Tenant. Surprise! Your domain name is not available because it has been registered in another tenant! Say what? While it is difficult to prevent this from happening (for reasons I will describe later in this post), there is some upfront planning you can be prepared to take if you encounter this during your tenant registration process.

This is more likely to occur with Education customers than Commercial/Enterprise/Business customers. More often than not, Education customers will find that their domain name is already associated with an existing Office 365 tenant that they did not create. However, this same problem can occur with Corporate customers because Power BI allows for automatic tenant creation when the first user signs up (if there was no previous tenant created with the primary email address of the user). 

In this blog post, we will focus mainly on Education customers, because it happens much more often. How does this happen? It’s by design. A self-provisioned tenant gets created whenever a student or faculty member signs up for Office “Online” using their .EDU email address at this website here:

http://office.com/student

image

The first account to do this will actually establish an Office 365 tenant for that organization. This is a huge help to larger organizations with small IT staff, as it enables students and staff to have self-service access to valuable and free services from Microsoft.

Side note 1:Some schools have purchased Campus agreements with Microsoft, allowing teachers and students to install the full Office applications on up to 5 PCs or Macs (not just browser-based Office Online) .  If your school provides this additional benefit, you’ll see the Install Office button on your Office 365 home page after you complete sign-up.

Side note 2: Microsoft has provided a promotion kit to help schools get the word out about the tremendous value of these services. This can help boost the schools image when trying to compete for incoming students $$$.

The tradeoff for free and easy is that the tenant name that gets created may not be the most ideal for long term use, for example: if a student name Jack using the email address of Jack@contoso.edu is the first to sign up for the free Office Professional Plus offer, and the tenant that gets created behind the scenes could be contoso2.onmicrosoft.com.  To learn more about self-provisioning see this article (here).

Here are the licenses that the student will be assigned if self-provisioned:

image

To disable automatic tenant join for new users: Set-MsolCompanySettings -AllowEmailVerifiedUsers $false

To enable automatic tenant join for new users: Set-MsolCompanySettings -AllowEmailVerifiedUsers $true

This applies to all Office 365 Education customers (Universities, Colleges, School Districts, etc)  – simply, any domain name ending in .EDU.  This blocking prevents new users in your organization from signing up for Power BI.

To learn more about disabling self-provisioning click (here).

It is possible to perform re-claim administrative authority over a self-provisioned Office 365 tenant. Some reasons why you may want to do this include:

  • Establish single-sign on with an on-premises Active Directory or 3rd party SSO service
  • Enforce IT or Security policy settings, especially because the default settings in an Office 365 tenant may or may not reflect the current policy of the organization (sharing policies, encryption policies, software installation, just to name a few examples).
  • Perform an on-premises migration of Email, SharePoint, or storage to Exchange Online, SharePoint Online or OneDrive for Business
  • If the organization has a long term initiative around tenant consolidation, user initiated tenants based on email enabled sub-domains may not be desired.
  • For multi-national organizations, user initiated tenants may be created in a data center that is not desired by the organization.
  • Self-created tenants could be perceived as ‘shadow IT’ – where there is limited organizational visibility or even knowledge of what users have signed up for the services, and usage of those services.

There are many other reasons why it is advantageous to perform the administrative takeover of an Office 365 tenant, but those are the top three.

Before you begin the takeover process (described here) –  you’ll first need to decide if you want to keep two separate Office 365 tenants, consolidate the accounts, or chose one versus another one. There are two good reasons for this:

1. Because your domain can only be associated with one Office 365 account.

2. The self-service tenant very likely has a number of faculty and students who may have data saved in OneDrive. Removing the domain name from the self-service tenant would cause data loss of anything stored in OneDrive, and will disrupt the users who were relying upon their cloud identity to register with Office 365. This is because passwords do not migrate over from the self-service tenant to the new tenant, and in many cases you would not want them to anyway, because you may want to use on-premises AD as the source of authority for authentication.   

 

Need help with this takeover process, or guidance with your next Office 365 Project? We can help you deploy any or all of the 21 features Included in Office 365 for a flat rate per month. To learn more about our Cloud Advisory Service, click here, or contact us at Hello@PatriotConsultingTech.com.

ExpressRoute Providers in Southern California

If you work in Southern California, you may be interested in finding out which telecommunications providers have connectivity into Microsoft Data Centers such as Azure and Office 365.

The list below ranks providers based on their proximity to Southern California. For the full list of locations and providers, scroll down.

image

Note: This is not an endorsement for any particular provider, but just a list of those who have local connections near Los Angeles.

Need help with your next Office 365 Project? We can help you deploy any or all of the 21 features Included in Office 365 for a flat rate per month.  Contact us at Hello@PatriotConsultingTech.com.

The full list of providers is located here: https://azure.microsoft.com/en-us/documentation/articles/expressroute-locations/

Delve Analytics First Look

In a previous post (here) I described how to enable Delve Analytics at the tenant level. After that has been enabled, the end-user can then enable it for themselves through a few clicks.

As an end-user first signing into the new Delve Analytics (part of the new Office 365 E5 license) we are first greeted with this welcome screen:

image

image

Click on Analytics on the left navigation pane

image

Click on ‘Go to Feature settings’

image

Enable Delve Analytics

image

Note the highlighted message ‘It may take up to a week for all changes to take effect’

Screen shots below. Before you judge me for not working a lot, keep in mind this is just my lab environment. Really !! =)

image

SNAGHTMLa1c1afe

image

image

 

Need help with your next Office 365 Project? We can help you deploy any or all of the 21 features Included in Office 365 for a flat rate per month.  Contact us at Hello@PatriotConsultingTech.com.

What is included in the Office 365 E5 license?

Many customers are asking what is included in the new E5 license that was announced on December 1st, 2015. The E5 license introduced several new products, and since it includes everything that exists in the E3 license, I thought it would be helpful to list all 20 features here:

       1. Office 365 Advanced eDiscovery

       2. Customer Lockbox

       3. Advanced Threat Protection

       4. Delve Analytics

       5. Power BI Pro

       6. Skype for Business Cloud PBX

       7. Skype for Business PSTN Conferencing (UNLIMITED CONFERENCE MINUTES – available now in 45 countries…   Toll-Free is not yet available but when it does become available, it will be an additional per minute charge)

       8. Skype Broadcast Meeting  (Note: requires latest Skype for business client for all presenters) (Note: all attendees require computer audio, as PSTN dial-in is not yet available for SFB Broadcast meeting)

       Note: Skype PSTN Calling is a separate add-on and is not included in the E5. However, remember that PSTN Calling is an ‘additive’ SKU that must be coupled with either E5 or a stand-alone Cloud PBX SKU).

 

The following 12 features are also included in the E5, as they are inherited from the E3:

       9. The latest desktop version of Office (aka Office 365 Pro Plus)

       10. Skype for Business Online (Plan 2) -> IM&P, Desktop Sharing, Web Conferencing, Peer to Peer Audio/Video Conferencing, (Dial-In PSTN conferencing from 3rd parties or MSFT can be added onto this E3 for $4/user/month)

       11. Exchange Online (Plan 2) (Unlimited Cloud Storage)

       12. SharePoint Online (Plan 2) (1TB storage per tenant, 500MB per user)

       13. OneDrive for Business (Unlimited Cloud Storage per user)

       14. Office Online

       15. Delve

       16. Sway

       17. Office 365 Planner Preview

    18. Azure Rights Management

19. Data Loss Prevention & Legal Hold

20. Azure Active Directory Basic

21. Voicemail

 

All of the above is available for just $35/user/month!

Need help with your next Office 365 Project? We can deploy all 21 features listed above for a flat rate per month.  Contact us at Hello@PatriotConsultingTech.com to learn more.

New Admin Controls Available for Office 365 Software Downloads

 

Microsoft announced today (here) that beginning today, Office 365 Administrators have new controls available to determine which software versions are available for their end users.  This setting will take effect on February 23rd, so you have a few weeks to decide which options you are going to select.

Note: This only applies to new software downloads on a go-forward basis. Previously downloaded copies of Office 365 ProPlus (2013 edition) will still be prompted to upgrade to the 2016 version unless administrative action is taken prior to February 23rd. See my blog post (here) for more details on this auto-upgrade and how to postpone it if you are not quite ready for it.

In the announcement, Microsoft also announced that the naming convention used to describe how frequently security updates get pushed down will be renamed from ‘current branch for business’ to ‘Deferred Channel build.’ (Although as you can see in the screen shot it still uses the ‘Current Branch for Business’ name.

image

 

Okay – I missed the “Memo” this time – what can I do to prevent this from happening again in the future?

If you’ve configured your users to get updates from a location on your internal network, then the upgrade to Office 2016 is under your control. What if you missed the memo on how to do this and you want to make sure you stay informed so that things like this don’t happen again? I recommend having someone in your organization stay focused on things like this by creating a position to discovery of upcoming changes, or hire a Cloud Architect to do this for you. If you do not have budget for a new position, or your existing staff is overwhelmed, then you may benefit from Cloud Advisory services from Patriot Consulting (visit our website by clicking here for more information).

Or you can always email us at Hello @ PatriotConsultingTech.com

How to access the new E5 Advanced eDiscovery (aka Equivio Analytics) (Part 2 of 2)

This is a continuation post from a 2 part series on accessing the new ‘Advanced eDiscovery’  (from an acquisition of a company called ‘Equivio’), now included in the Microsoft Office 365 “E5” SKU. To read part 1, click this link (here).

After waiting approximately 24 hours for my access to the Advanced eDiscovery center to be granted, I was able to access Equivio from the Office 365 Compliance Center.

The compliance center offers three choices for searching content. A fourth location to search content is the eDiscovery search within the Exchange Online admin center. Microsoft is investing heavily into the Compliance Search capability and so customers should be keeping an eye on that over the next 12 months, while recognizing that some of the needed functionality remains in the SharePoint eDiscovery Center and Exchange eDiscovery Center.

1. SharePoint eDiscovery Center

2. Compliance Search

3. Equivio Analytics (aka Advanced eDiscovery)

4. Exchange eDiscovery Search (not directly accessible from the Compliance Center)

5. Protection Center (This is in Beta now, and will eventually replace the Compliance Center).

image

Compliance Search is useful for quick search results across Exchange, SharePoint, OneDrive and O365 Groups. At the time of this writing, export is limited to single items. Bulk export from Compliance Search is on the roadmap. Until then,  the other three options include bulk export.

Note: The export option in these tools have separate export formats, so depending on your export need, that may determine which search tool you select. For example, the Exchange eDiscovery search will export to .PST, whereas the SharePoint eDiscovery will export to the Electronic Discovery Reference Model standard.

TIP: The first time you use the SharePoint eDiscovery Center, you will need to add a connector to Exchange Online before you can search mailboxes. For guidance on the SharePoint eDiscovery Center see this TechNet Article (here).

TIP: There is no PowerShell option (yet) to export a mailbox to PST. The work-around is to use the Exchange eDiscovery search without keywords so that the entire mailbox is returned in the search results, then select the option to export to PST. So my advice is to use the Exchange eDiscovery search if you only need to search email, otherwise use the SharePoint eDiscovery center if you need to search SharePoint/OneDrive & Email.  image

 

Ok.. so getting back to Equivio Analytics aka Advanced eDiscovery.

First, you need to make sure you are an eDiscovery Administrator. This is a member of the eDiscovery Manager role group but there is a new checkbox that only appears when you add new users to it. If you were previously a member, you now need to remove yourself and re-add yourself back in to see the new checkbox, otherwise you will receive an access denied error message when trying to browse to Equivio Analytics the first time.

image

 

SNAGHTMLbf9040b

Once you have access, you can click on the eDiscovery menu and then ‘Go to Equivio Analytics’

image

In order to get data into Equivio, you first need to start with a Compliance Search in the Compliance Center and then you can export search results to Equivio. This diagram shows the workflow:

image

 

image

After performing a search I see the option to export the results to Equivio

image

The first time I tried this, I was prompted for my email address and was notified that I would be emailed when it was ready for me. After waiting 45 minutes, I received an email from Office365Compliance@microsoft.com  “Sorry, but the results for compliance search Compliance Search didn’t export to Equivio.”

That’s it – nothing to work from. So I returned to Equivio and created a blank case.

SNAGHTMLbffcd2a

I then repeated the export and this time it succeeded. However, when I tried to create a second search and have it go to a separate case, it inserted the new search results into the same case in Equivio.

image

There doesn’t appear to be a way to tell the Compliance Center that you want to insert the new search results into a separate case in Equivio.  I imagine they are working hard to iron out the integration, since this was an acquisition

With the case highlighted the next step is to click on ‘Go to case’ in the bottom right

image

From there, you follow the bread crumb trail to Prepare > Process > and Analyze the data before moving on to Relevance and Export.

image

At this point there is no working help menu within the application.

image

Fortunately, there is guidance for Advanced eDiscovery on TechNet here: https://technet.microsoft.com/en-us/library/mt303716.aspx

Despite the rough edges of getting into this tool,  this tool could save an organization thousands upon thousands of dollars in legal fees during a discovery by reducing the total number of documents that truly need to be considered relevant for a case. I am confident that Microsoft will improve the integration and the user interface in the next year.

Benefits:

  • Reduced costs. Reviewers are directed to what’s important – i.e., to documents that contain unique information, and to the unique information within each document. Proven in hundreds of cases, Equivio’s technology consistently reduces review and handling costs by 30 to 50%.
  • Less time. In many situations, it’s impossible to review all the documents in the given time window. Equivio enables prioritized review by zooming in on value-added, unique data.
  • Less risk. By directing reviewers to the unique documents, and to the unique data in those documents, Equivio reduces the risk of missing critical information.
  • Consistent treatment. The Equivio groupings allow reviews to apply tags across a near-duplicate set or email thread to ensure very similar documents are treated consistently. The need for consistency applies throughout the data cycle, from the feed of documents into the retention archive, through the implementation of storage policies, and the treatment of documents in a specific litigation or regulatory event.
  • Accessing the data users need. By allowing the virtual suppression of redundant data, Equivio helps users cut directly to the information they need.” Reference

Note: Last week, Microsoft announced (here) that you can now export data out of Equivio and make it available for 3rd party discovery applications. This is helpful if you made a large investment in other tools and you are looking to integrate with a previous investment.

Need help with your next Office 365 Project? Contact us at Hello@PatriotConsultingTech.com

Using the new Microsoft OMS to monitor Active Directory Health from Azure

Microsoft Operations Management Suite, which runs in Azure, can check the health of on-premises Active Directory, including replication health.

Why is it so important to check AD replication health? Well, if you are responsible for managing Active Directory then you know how easy it is for AD to become unhealthy, and you also know how problematic it can be to restore health. For example, a power outage that results in an Active Directory server going offline for longer than tombstone life of 180 days can cause ‘lingering objects’ to have to be removed.

So the best practice is to use monitoring tools to make sure AD remains healthy, so that you don’t have to spend long hours repairing AD.

image

 

Need help installing Microsoft OMS? We are here to help. Drop us a line at Hello@PatriotConsultingTech.com

Azure AD Connect (Dirsync) Password Sync taking too long

I was assisting a customer who reported that Azure AD Connect (aka Dirsync) was taking too long for passwords to synchronize. It was such a huge lag that they assumed it was broken entirely.

Upon inspecting the Application Event Log on the Dirsync server for event ID 656, I observed a large gap between when the password was set on the Domain Controller and when the Event log on the Dirsync server picked up the change.

SNAGHTML61bdfde

This is not expected because the synchronization service polls on-premises AD for password changes every 2 minutes for password updates. The overhead to then hash the password, transfer it to Azure AD’s connector, and received on the far end is an additional minute (if all the stars are aligned). So three minutes is a reasonable expectation for passwords to sync to Azure AD. However, 14 minutes? Something ain’t right!

Upon inspection in the MIIS client, I observed that the domain controller that Dirsync was connecting to was 62 milliseconds away, and *not* the nearby DC in the same site as Dirsync. This is viewable in the ‘last used’ field in the screen shot below.

The Fix

Configuring Azure AD Connect to use preferred domain controllers solved the problem.

SNAGHTML6259900

Results

This reduced the synchronization lag from 14 minutes to 40 seconds! That is a 95% percent reduction in lag!

SNAGHTML623b3f5

Need help with an Office 365 Project? Visit our website at www.PatriotConsultingTech.com or drop us a line at hello@patriotconsultingtech.com