Microsoft has a global MFA override coming to all accounts as a default; their term is “Security Defaults”. To turn this off, log in as Office 365 admin and then:
Category: Microsoft 365
Quick link to turn off globally-forced MFA in Office 365 ("Security Defaults")
article #1543, updated 456 days ago
DeletingCloudOnlyObjectNotAllowed in Azure/AD Synchronization (Connect)
article #1534, updated 492 days ago
A customer had several of these errors being reported in Azure AD Connect. They were all users which had been converted to cloud-only. Several solutions are on Microsoft and related sites, none worked except this on the domain controller which has AAC:
- Open administrative Powershell
- To stop synchronization:
set-adsyncscheduler -synccycleenabled $false
- In the AAC Synchronization Service Manager, click Connectors
- Right-click on the AD connector, click delete, choose “Deleted connector space only”, click OK
- Do the same for the Azure connector
- To restart synchronization:
set-adsyncscheduler -synccycleenabled $true
- In services.msc, restart “Microsoft Azure AD Sync”
- Reinitialize sync:
Start-ADSyncSyncCycle -PolicyType Initial
Add SendAs to 365 Distribution List using Powershell
article #1533, updated 497 days ago
Here is how to add Send As permissions for a user, to a distribution list, in Powershell.
- First, connect to the 365 tenant.
Install modules if needed:
Set-Executionpolicy Bypass -Scope Process Install-Module PowerShellGet -Force -AllowClobber Install-Module ExchangeOnlineManagement -Force -AllowClobber
Connect to the tenant:
Connect-ExchangeOnline -UserPrincipalName adminuser@domain.com
- Then make the setting:
Add-RecipientPermission -Identity distgroup@domain.com -Trustee user@domain.com -AccessRights SendAs
Downloading Office 365 applications esp. when the button isn't there
article #1506, updated 636 days ago
Sometimes, when one logs into https://portal.office.com, the link/button for downloading is not present at the upper-right corner. One thing to try is this, right after login:
https://portal.office.com/account/?ref=MeControl
If that doesn’t get you to downloads, try these steps:
Click on ID ball at the upper right to pull down menu
Click on View Account
Click on Subscriptions at lower left
Click on Apps & devices near lower left
Enable Modern Authentication for Office 2013
article #1446, updated 730 days ago
It’s by registry entry. Create these as DWORDs and set them to value 1:
HKCU\SOFTWARE\Microsoft\Office\15.0\Common\Identity\EnableADAL HKCU\SOFTWARE\Microsoft\Office\15.0\Common\Identity\Version HKCU\SOFTWARE\Microsoft\Exchange\AlwaysUseMSOAuthForAutoDiscover
Versions of Azure AD Connect
article #1249, updated 846 days ago
Version overview:
docs.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-version-history
Office 365 says "More information required", demanding MFA
article #1477, updated 877 days ago
There are a few different places to turn this off. To turn two of them off:
- First log into the tenant, and browse here: aad.portal.azure.com
- Then click on “Azure Active Directory” on the left pane.
- Click on “Password reset” on the middle pane (might need to scroll down). The Properties of “Password reset” will be visible. In the right pane, choose None, and click Save.
- With “Password reset” still visible, click “Registration” in the middle pane.
- Under “Require users to register when signing in?”, choose No, and click Save.
There are a few others, and there may well be more in the future.
When AD -> Azure Sync Fails or Needs Set Up for a User
article #1417, updated 1113 days ago
There are many ways of doing this. Here is one way to bring everything into a single consistent behavior, a landing place from which you can vary slightly at need.
This presumes that you have Azure/AD sync installed and working in general, and yielding errors in the Synchronization Service window for one or more users. Make sure that you don’t have duplicate email addresses in AD, that could be bad.
The first steps are in Active Directory Users and Computers.
- Set the user’s email correctly in his/her AD object, in “E-mail” under General.
- Set proxyAddresses in the Attribute Editor. The primary email address has to be the same, and in proxyAddresses has to be of the format “SMTP:email@domain.com”. There can be others in proxyAddresses but smtp must be lowercase. Also in proxyAddresses, set mailNickname blank.
- Under Account, either the user login name plus the dropdown domain is to be the same as the above, or it is to be a valid login according to the O365 console. If the dropdown domain list is local only, you can add the Internet domain list in Active Directory Domains and Trusts, with a right-click on the root level in the left pane of that window, and then an add of one or more alternative UPN suffixes. Then restart ADUC and the domain(s) you just added will be available in the dropdown.
Now we do some other things.
- Run Azure/AD sync, this is CMD, do it as administrator:
repadmin /syncall /AdeP @"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command ^ "Import-Module ADSync; Start-ADSyncSyncCycle -PolicyType Delta"
- If you see errors in the Synchronization Service window, you’ll need something called a “hard match”, which changes enough to connect the AD user with the Azure user. Here’s a script for it, in Powershell. You’ll need to run it as administrator on a domain controller, and it will ask you to log into the O365 tenant. Items of note:
- This uses something called UPN, UserPrincipalName. While Azure’s UPN is the O365 “primary email address”, Active Directory’s UPN is the double item under Profile in AD, the username plus the domain dropdown.
- If you use this approach, the Office 365 login is changed to be the same as the AD login — which is a good thing in the net result, it keeps things very consistent and predictable.
- Once the hard match is complete, you can change anything on the AD side and it will mirror up to Azure.
############################################ # Active Directory / Office 365 Hard Match # ############################################ $ADUPN = 'active_directory_user@companynetwork.com' $AzureUPN = 'azure_user@companynetwork.com' '############################################' '# Active Directory / Office 365 Hard Match #' '############################################' '' 'Initiating prep for hard match.' "Active Directory : $ADUPN" "Azure AD : $AzureUPN" '' # Sets TLS version. Necessary for some platforms. [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 $reportStatus = '' $currentOp = '' function ShowProgress { param( [string]$reportStatus, [string]$currentOp ) Write-Progress -Activity "Hard Match" -Status $reportStatus -PercentComplete -1 -CurrentOperation $currentOp # Write-Progress is not compatible with some remote shell methods. } Function PrepareModule { param( [string]$ModuleName ) If (Get-Module -ListAvailable -Name $ModuleName) { Update-Module $ModuleName } Else { Install-Module $ModuleName } } Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted -Force > $null 'Preparing Powershell environment...' ShowProgress("Preparing Powershell environment...","Setting up to use Powershell Gallery...") ShowProgress("Preparing Powershell environment:","Setting up to use page provider NuGet...") Install-PackageProvider -Name NuGet -Force | Out-Null # This appears to set PSGallery nicely when need be Register-PSRepository -Default -InstallationPolicy Trusted 2> $null Set-PSRepository -InstallationPolicy Trusted -Name PSGallery ShowProgress("Preparing Powershell environment...","Checking/preparing module NuGet...") PrepareModule("NuGet") ShowProgress("Preparing Powershell environment...","Checking/preparing module AzureAD...") PrepareModule("AzureAD") '' 'Setting up hard match...' '' 'Connect to AzureAD:' Connect-AzureAD '' 'Turn off AZ/AD Sync...' '' Set-ADSyncScheduler -SyncCycleEnabled $false "Now get original Azure ImmutableID for $AzureUPN ..." $AzureUser = Get-AzureADUser -SearchString $AzureUPN $OriginalAzureImmutableID = $AzureUser.ImmutableID "Extracted Azure ImmutableID: $OriginalAzureImmutableID" "" "" "And now extract AD GUID for $ADUPN ..." ldifde -f export.txt -r "(Userprincipalname=$ADUPN)" -l * $ADGUID = (-split (type export.txt | select-string "ObjectGUID"))[1] '' "Extracted AD GUID: $ADGUID" "" "" 'Set AD GUID as Azure ImmutableID...' Set-AzureADuser -ObjectID $AzureUser.ObjectID -ImmutableID $ADGUID '' 'New Azure ImmutableID retrieved as confirmation:' $AzureUser = Get-AzureADUser -SearchString $AzureUPN $AzureUser.ImmutableID '' 'Finally, turn on AZ/AD Sync again...' Set-ADSyncScheduler -SyncCycleEnabled $true 'Done!'
The Office 365 console...
article #1424, updated 1240 days ago
…is often like a flying carpet in a hurricane.
Convert Exchange Online / Office 365 Mailbox from AD Sync to Cloud Only
article #1368, updated 1543 days ago
In administrative Powershell:
Install-Module AzureAD
Install-Module MSOnline
Connect-AzureAD
Connect-MsolService
In Active Directory Users and Computers, remove the user object from OU being AD-synched. Then complete an Azure/AD sync cycle. Then:
Restore-MsolUser -UserPrincipalName users_login_probably_email
Set-MsolUser -UserPrincipalName users_login_probably_email -ImmutableId "$null"
Do the last step before the next automatic AD sync!