It does. You can continue to have a break glass account that is excluded from MFA and doesn’t use MFA, but if a problem happens that account will not be able to satisfy the requirement to undergo an MFA challenge to access Azure administrative tools. For instance, the account could access the Microsoft 365 admin center but not the Entra admin center. To make sure that the break glass account can access everything, it must be able to satisfy MFA. The recommended approach is to use a strong authentication method like a FIDO2 key.

This is an absurd change given the lack of a reprocess option and the dysfunctionality of their Admin center UI. Waiting 5-10 seconds for a view search to populate or execute bleeds time, and we’ve been sitting around for 10 minutes waiting for office to inform itself that a license was assigned. So I guess we’ll have to build functional UI’s in PowerShell until they go and deprecate anything built there.

Astonishingly short-sited as per normal for everything MC these days.

It shouldn’t. Support for external MFA providers is in preview. I’d check with DUO.

We use DUO MFA for our regular users, and for privileged accounts, we use a Conditional Access policy. Do you think this setup will impact our privileged accounts who are assigned different Entra ID roles?

Looks like the cmdlet wants a GUID. It doesn’t care what kind of GUID it is… so I did:

$Guid = New-Guid
Set-CsTeamsUpdateManagementPolicy -Identity Global -DisabledInProductMessages $Guid.toString()

Teams accepted the value. It has no relevance to the two defined to control messages, so I guess this will stop the messages being suppressed. I will bug the issue for the developers.

Yes, it failed with ‘Object reference not set to an instance of an object’.

Did you try using $Null as a value for $disabledMessages?

The new Outlook is GA to allow organizations that want to use it to receive formal support. Outlook classic will be around until 2029 at least. There’s lots of development time between now and then.

Sure. Some Graph requests to retrieve the meetings for the user would do the trick…

So there are no groups that the script can find to update those settings, which is the reason why you don’t see the settings being updated. Try setting the properties of a group to autosubscribe new members and see what happens.

Set-UnifiedGroup -Identity ‘Group to test’ -AutoSubscribeNewMembers:$True

No, there aren’t.

Ahem, I don’t work for Microsoft and have no responsibility for how the software works. AFAIK, this is the first article since the introduction of Teams in 2017 to highlight the problem. That’s all we can do here – highlight issues and help people understand what they might have to do to workaround or solve problems.

There are going to be feature gaps during the transition – I think that’s a safe prediction. However, the idea of bringing license management into a single place seems like a good idea.Execution of that idea is what Microsoft will be judged on.

I just checked and the code ran without a problem. Are there two objects in the $Groups array after the first snippet?

Nope. It moves to the Microsoft 365 admin center.

That’s true, but the meeting organizer can grant access to files in a folder (or the complete folder) to allow them to download recordings and transcripts.

Contact Microsoft Support. They can access your tenant. I can’t.

The presenter can still record the meeting if only some have consented but not all: Yes. It’s an organizer or co-organizer option to record a meeting.
If the participant did not consent, their participant icon will not show? You mentioned the Avatar mesh: Even if they don’t give consent, the participant is in the meeting albeit in a view only mode. They are listed as a participant and appear in the attendance report.
If the presenter records without consent of one participant but others consent, will the non-consent participant be able to attend the entire time without obstruction? Participants who do not consent are in view-only mode. They can’t interact with sharable content, for instance.
If they did not consent, will the non-consent participant attend anonymously without any indication they attended? Is there any evidence they were there? No. Their presence in noted in the attendance report.

All of this stuff is easy to test… set up a trial meeting, start recording, connect as a participant and don’t give consent, and note what happens.

I’m not sure what the Teams group are working on in this area… and am constrained by NDA!

Well, I won’t believe anything 100% until I have tested it myself when the code is available, but that’s what the developers say.

Best news I’ve heard all week. Thank you!

I asked the development group.

I understand what you mean, but the page number is not necessarily what an author expects it to be after all changes are applied. You’d be very frustrated to be told to look at page 100 when the actual change appears on 102.

I mean adding page number for new information. Like: Microsoft-managed conditional access policies for management portals, check page 100.

We’ve thought about inserting change markers but the overhead (time, effort) is probably too much for the benefit we think would be achieved. We think about this kind of stuff all the time, but right now we prefer to use the available time to keep on top of the changes that occur in Microsoft 365.

I’m afraid so. Our value proposition is that we publish a completely new book every month where all the changes are integrated with the rest of the text. It means that what you read is our current view on a topic without the need to consult change logs or anything else.

And how then changes should be checked not re-reading whole chapter? ) Just search for the text?

No. The page numbers are changeable and wouldn’t be accurate.

I forgot to mention. The main reason why we use the employeeType extension is because the Dynamic Rules in groups doesn’t include user.employeeType. Kind of a head scratcher why they haven’t included that.

Write a different array or $null into the property that disables in-product messages.

There’s retention applied by OneDrive and retention applied by Purview.

It seems clear that any OneDrive site unlicensed for more than 90 days will be archived. How long it remains in that state depends on whether a retention hold applies to the site or files in the site OR the OneDrive retention period. At least, that’s my understanding. We need to test this when the code is available.

1. It’s up to you where to store the output. For Azure Automation, you can create a local file and then upload it to SharePoint Online or another website.
2. The code is available for you to beautify the HTML output…
3. Create an email, attach the file, send the email using the Graph commands for this purpose. https://practical365.com/send-email-powershell-graph/

Thank you!

Hah! We get this kind of thing all the time as we maintain the content of the Office 365 for IT Pros eBook…

I actually checked again and it appears to populate now after 2 years of using this script
Get-MgUser -UserId -Property employeetype |select employeetype

EmployeeType
————
Employee

Got it. Good reason!

It doesn’t populate from AD Connect so we have to use the extension.

There is an EmployeeType property. Is there any reason why you don’t use it?

I’m sorry, but I don’t think there is any way to revert the feature. It is what it is… You could protest on the Teams feedback portal: https://feedbackportal.microsoft.com/feedback/forum/ad198462-1c1c-ec11-b6e7-0022481f8472

I can experience the same behavior. We have lots of customer teams that get created from a MS Flow following a certain structure (5 general channels for each team). Lots of these channels are hidden now. I already unchecked the button in MS Teams saying:

“Clean up channel list” but it seems like this is not reverting it. In some customer teams we have more than 100 channels for existing projects and the general channels such as “Basic Information” for example is at the very bottom and I would need to manually make it visible. This is obviously now acceptable.

Does anyone know:

Is there a way to globally deactivate that feature via MS Teams Admin and/or Intune to prevent newly registered devices / teams from cleaning up the channel list? Could not find anything so far.

How can I revert these changes on existing devices so that it was like it was before (the general channels are on the top again).

Thanks!!

For managers, we utilize EmployeeType property in AD (employee, contractor, service, etc).
I populate a group of just managers of employees & contractors.

$users = Get-MgUser -Filter “employeeId ne null” -all -ConsistencyLevel eventual -CountVariable CountVar
ForEach ($user in $users){
if (Get-MgUserDirectReport -UserId $user.id -All) {

$manager = $user
#get all direct reports
$allDirects = Get-MgUserDirectReport -UserId $manager.id -All

# add manager to manager array if the employeetype of the direct report is valid.
foreach ($direct in $allDirects) {
$employeeType = (Get-MgUser -UserId $direct.id -Property extension_72865f8793294a44b04f437101a06033_employeeType).additionalproperties.extension_72865f8793294a44b04f437101a06033_employeeType
if (($employeeType -eq “Employee”) -or ($employeeType -eq “Vendor”) -or ($employeeType -eq “Temp”) -or ($employeeType -eq “Contractor”)) {
$managers += $manager

# we only need to find one valid direct report, then we can move to the next manager.
break
}
}
}
}

I then compare the array to the existing group members and add or subtract if needed.
It takes about 10 min to run for 3000 users.

I believe that point is made in the article.

I guess you could take the creation date of the user account and use that as the basis for license assignment. The license assignment dates reported by the Graph can be misleading: https://practical365.com/azure-ad-license-assignment-dates/

It all depends on how soon background jobs run…

Thank you. It just allowed me to run the command. So in my case it took about 30 minutes. I’m just impatiant 😉 Thank you for quick response.

It can take SharePoint a few days to detect a license.

When I run the command Set-SPOSite -Identity “MySharePointSite” -BlockDownloadPolicy $true

i get the following message:

Set-SPOSite : You do not have required licenses to perform this operation. Please read here for licensing related
requirements : https://learn.microsoft.com/en-US/sharepoint/block-download-from-sites

Does it take long for the SharePoint to acknowledge i have the license? i have signed out of browser and PowerShell several times.

No idea.

Thank you

The last change to the script was in August 2022. There is only one script in the repository and that’s https://github.com/12Knocksinna/Office365itpros/blob/master/GetGraphUserStatisticsReport.PS1

I have no idea. I just tried the script here and it wroked perfectly.

Thanks!

“Get-SPOContainer : Parameter set cannot be resolved using the specified named parameters.
At C:\files2\loop workspaces report.ps1:67 char:26”

Thanks for your contribution. From a quick read of the code, it seems like it’s much like the idea I implemented in PowerShell: Find all teams, find the apps in each team, if an app is present that seems like it’s the incoming webhook, report.

To anyone else contemplating using code downloaded from the internet. Remember to check the code carefully before running it in production. It’s always best (and safest) to run on a test tenant first.

If other system administrators are having difficulties locating the affected teams:
I have written a small tool in Golang that uses the Graph API to output the affected teams.

https://github.com/SecNex/teams-webhook-finder

This has helped us enormously, as Microsoft does not offer its own solution for reading the affected channels and teams. We have over 350 teams in our company, which we would otherwise have had to search through manually.

I hope I could help someone here with this.

Independently of my day job, I would like to create an alternative to the native “incoming webhooks”. Maybe someone will benefit from it.

You have picked a very old article that appeared well before address book policy routing was available. This feature has nothing to do with Teams. It affects how Outlook clients display GAL contents. https://learn.microsoft.com/en-us/exchange/address-books/address-book-policies/turn-on-address-book-policy-routing. “When ABP routing is turned on, users that are assigned to different GALs appear as external recipients and won’t be able to view each other’s contact cards.”

Litigation hold is a form of retention policy applied by Exchange Online. The hold release is controlled by the LitigationHoldEnabled setting (it’s generation one compliance technology), but the point is that ligitation hold can hold mailboxes as inactive for as long as the hold exists.

Nope to either question.

Yes. Set-DistributionGroup -Identity xxxx -Description ‘Whatever I want’