Microsoft Teams and Microsoft Flow are now a match made in the cloud. These features are only in preview currently but no doubt we can expect more and more as the Microsoft Team wagon rolls on.
So whats in preview today!!
Get Messages
Post a choice of option as the Flow bot to a user
Post a message (v2)
Post a reply to a message
Create a channel
List channels
List Teams
Post a message as the Flow bot to a channel
Post a message as the Flow bot to a user
Post your own adaptive card as the Flow bot to a channel
Post your own adaptive card as the Flow bot to a user
I am currently playing with these options and will blog about the usage as soon as possible.
As a big advocate for Office ProPlus I am delighted to now see that Microsoft Teams now apart of the ProPlus deliver mechanism. However, just like any Microsoft product, it does have its caveats.
Microsoft Teams will only be included with NEW installations of Office 365 ProPlus dependent on the channel you are using. The below shows the schedule of the introduction but this is subject to change.
Update channel
Version
Date
Monthly Channel
Version 1902
March 4, 2019
Semi-Annual Channel (Targeted)
Version 1902
March 12, 2019
Semi-Annual Channel
Version 1902
July 9, 2019
Important Note:
Teams are also included with the following new installations: Office 365 Business, starting with Version 1901, which was released on January 31, 2019. Office 365 Business is the version of Office that is included with certain business plans, such as the Microsoft 365 Business plan and the Office 365 Business Premium plan.
Office for Mac, starting with Version 16.21, which was released on January 16, 2019. Office for Mac comes with any plan that includes Office 365 Business or Office 365 ProPlus. For more information, see Microsoft Teams installations on a Mac.
Now Microsoft Teams is apart of the Office Deployment tool it is now subject to all the controls we are common use to so we exclude Teams if we really to 🙂 but why would we do that.
What about existing deployments of Office 365 ProPlus?
At the time of this post, it is not possible to get Microsoft Teams if you have an existing deployment of Office 365 ProPlus. Microsoft has announced that in Version 1906 Microsoft Teams will be shipped to existing deployment running this version. The table below gives an indication of when we can expect the rollout of Teams but if you are using Monthly Channel (Targeted) you should be seeing Microsoft appearing approximately on 25th June 2019.
Update channel
Version
Date
Monthly Channel
Version 1906
July 9, 2019
Semi-Annual Channel (Targeted)
To be determined
September 10, 2019
Semi-Annual Channel
To be determined
January 2020
If you don’t want Teams to be added to existing installations of Office 365 ProPlus when you update to a new version, you can use Group Policy or the Office Deployment Tool to exclude the installation.
Always keep up to date.
Make sure you’re using the most current version of the Office Deployment tool available on the Microsoft Download Center.
Temporarily, the name and help text for this policy setting is available only in English. The name and help text will be available in the usual set of languages by June 14, 2019.
Updating Microsoft Teams !! It doesnt follow the normal ProPlus cycles.
Once Microsoft Teams is installed, it automatically updates approximately every two weeks with new features and quality updates. This doesn‘t follow the normal update cycle for Office 365 ProPlus as other applications receive updates depending on which channel they’re on.
In recent times I have been playing with a number of PowerShell modules and now decided to have a bit of a clean up or in the world of PowerShell and Marvel Install-Thanos
if ($ModuleCheck) {
Write-Host 'Info: Detected an installation of the',$Module.Name,'Module' -ForegroundColor Green
$Module = Get-Module -Name $Module.Name -ListAvailable
Microsoft 365 Device Management otherwise known as InTune, is a very popular and command device management solution you will see in most organizations. The evolution of InTune has moved very quickly with the times and you probably have the correct licenses within your organization but are currently using something like AirWatch. This post is going to dive into my personal tenant where I have configured 365 Device Management for my Android phone. In this post I am going to run through the basics of getting Microsoft 365 Device Management up and running for mobile devices likes phones and tablets. All configuration is based on what is current set within my own environment and may not apply to your organisation.
The Dashboard
Microsoft 365 Device Management Dashboard
The Microsoft 365 Device Management dashboard is configurable to your requirements. If there is something on the dashboard you would like to see or not, you can easily edit the page and add in additional tiles as shown below.
Editing the Dashboard
You can also create your own Dashboard leaving the defaults as they are;
Customized Dashboard
All Services
This section contains all the services that available within the M365 Device Management Portal, as you can some of the options dont know contain a gold star. All this basically means is that the option is not displayed on your left hand panel which is customizable to the options you want to see.
All M365 Device Management Services
Device Enrollment
Apple enrollment
In order to support iOS device Microsoft inTune requires an Apple MDM Push Certificate to manage and support multiple enrollment methods.
Android enrollment
Microsoft Intune by default supports all Android devices. Managed Google Play enables management of Work Profile and other Android Enterprise functionality.
Android Enterprise provides 3 additional functions within this selected once Managed Google Play is configured.
Personal devices with work profiles
This options allows your corporation to manage corporate data and apps on user-owned Android device. You are able to approve applications within the Google Play Store which you organization would like to manage for example Outlook. Once the applications are approved, Enrollment Restrictions allows you to configure with greater control, which groups of users should be managed using Work Profiles.
Corporate-owned dedicated devices
This option allows your corporation to manage manage device owner enrollments for kiosk and task devices using with QR Codes or tokens.
This option is only in Preview currently and more developments are expected. In its current state, end users are able to enroll their corporate-owned devices by sending a company token. You can also use the Zero Touch Portal for auto provisioning deployment, this features apart of the InTune portal but will be coming soon.
Windows enrollment
In this section we can configure Microsoft Intune enrollment for Windows devices.
Automatic Enrollment
This options allows your corporation to configure Automatic Enrollment when a Windows devices join or register with Azure Active Directory. You can configure user scopes for MDM and MAM.
Unsure of the the different between the two?
MDM: addresses lack of control over corporate and personal devices, and lost device security
Ensures device compliance through user and device registration, configuration on-premisesand passcode management
Secures devices on the network so you can monitor, report, track and update devices – and even locate, lock and wipe devices, if lost or stolen
MAM: addresses lack of compliance with data and privacy requirements, and lost data retrieval
User identity policy, single sign-on and conditional access tailored
by role and device (with Intune or Active Directory on premises or in
the cloud)
Monitors and pushes app updates, including mobile document
management for online or cloud-provisioned apps like SharePoint and
OneDrive
Windows Hello for Business
This option allows your corporation to replace password with strong two-factor authentication. Please note: This is a default Windows Hello for Business configuration applied with the lowest priority to all users regardless of group membership. Devices must be Windows 10, Windows 10 Mobile or later to be supported.
CNAME Validation
This option is a must for all organizations as its removes the need for end user to provide the MDM server address when enrolling this devices.
Enrollment Status Page
This option allows your end user to see the status of how the enrollment process. However, you can also block devices until all apps and profiles are installed.
Deployment Profiles
Windows Autopilot deployment profiles lets you customize the out-of-box experience for your devices
Devices
Windows Autopilot lets you customize the out-of-box experience (OOBE) for your users.
Intune connector for Active Directory
This option requires your organisation to download the Intune connector for Active Directory to support the Hybrid connection for Azure AD.
Terms and conditions
This option can be configured with Intune but the look and feel is quite basic as shown below;
Intune T&Cs
However, if you configure Azure AD T&C it gives a better slicker output within your Company Portal.
Enrollment restrictions
A device must comply with the highest priority enrollment restrictions assigned to its user. You can drag a device restriction to change its priority. Default restrictions are lowest priority for all users and govern userless enrollments. Default restrictions may be edited, but not deleted.
Device categories
Create device categories from which users must choose during device enrollment. You can filter reports and create Azure Active Directory device groups based on device categories
Corporate device identifiers
This option you add devices in based on the IMEI or serial, this can be done manually or via CSV upload.
Just a bit like Thanos you can selectively wipe your corporate data if you have implemented app protection policy. This provides extra flexibility for managing your corporate data across company and non-company owned device. I am currently working on an organisation where users are nervous enrolling their personal devices via the Company Portal. As an Administrator has the ability to completely Factory Reset their devices but with selectively wiping only corporate data using a particular app like (Outlook) has calmed their woes.
Don’t get me wrong, everyone is human and mistakes can be made but educating your Service Desk or responsible parties for InTune in using selective wipe reduces the risk of the Thanos Factory Reset Button.
Captain America “No you won’t Factory Reset my device”
Create an app protection policy using access actions
Provide Information for Name, Description and Platform Fields Select Apps
Select all the applications you would like to manage with selective wipe Press Select
Under Settings you can either leave the defaults or modify to your requirements. Press Create to finish the creation of the Application Protection Policy you can repeat this process for other platform you if you require.
Wiping Applications
Under App selective wipe Click Create wipe request
Under Users Find a select the users who you would like to wipe Under Device Select the device you would like to wipe
Important Notice
Please note: It can take anywhere up to 30 minutes for this process to complete, I have seen it take up to nearly 45 minutes within my own testing.
Once the applications are listed as completed, on the select device all corporate data will be removed safety not affecting another the users normal mail accounts or applications.
In this post, I will look at how to modify the required Registry Keys for Windows Server 2012R2 / 2016 Update settings using PowerShell. PowerShell is one of the gems within Microsoft and enables us to work with systems without the help of a GUI.
Windows always looks at registry keys located in the following hive: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
Typically there is a key named ‘NoAutoUpdate’ with a value in the range 2-5, and have the following meaning:
– 1 = Disable Updates – Only supported on Windows 2012 R2. – 2 = Notify before download. – 3 = Automatically download and notify of installation. – 4 = Automatically download and schedule installation. Only valid if values exist for ScheduledInstallDay and ScheduledInstallTime. – 5 = Automatic Updates is required and users can configure it.
But if there is a ‘NoAutoUpdate’ key with the value of ‘1’, no updates will be processed by Windows.
You can change the registry key with the help of Powershell directly:
Working as a Microsoft Cloud Consultant sometimes its hard to keep update to all the latest release of the required PowerShell modules installed on your client machine. Would it be nice if there was a script that took all that pain away?
Say hello to Get-InstalledModulesUpdate.ps1 script
This script is based off my Microsoft Teams Detection script but instead of looking at just that module. I am grabbing all your installed PowerShell module and checking each one against the PSGallery
Module checking
As you can see from my screen shot the script has looked at each modules installed on my client machine and compared to the online version. If a legacy module was detected the update process would start to remove the old version and install the latest from the gallery.
This script is available via my Github or via this site.
Baseline policy: Require MFA for Service Management (Preview)
Baseline policy: End user protection (Preview)
This policy protects users by requiring multi-factor authentication
(MFA) during risky sign-in attempts to all applications. Users with
leaked credentials are blocked from signing in until a password reset.
Once the policy is enabled, users are required to register for MFA within 14 days of their first login attempt. The default method of MFA registration is the Microsoft Authenticator App.
This policy is either On or Off and you can also exclude users from receiving this policy
This policy blocks all sign-ins using legacy authentication protocols
that don’t support multi-factor authentication (such as IMAP, POP,
SMTP).
The policy does not block Exchange ActiveSync.
Office 2013 (without registry keys)
Office 2010
Thunderbird client
Legacy Skype for Business
Native Android mail client
This policy is either On or Off and you can also exclude users from receiving this policy. This policy is great as I have configured a custom built policy for just this but my policy also includes Exchange Active Sync.
Baseline policy: Require MFA for Service Management (Preview)
This policy requires users logging into services that rely on the
Azure Resource Manager API to perform multi-factor authentication (MFA).
Services requiring MFA include:
Azure Portal
Azure Command Line Interface (CLI)
Azure PowerShell Module
This policy is either On or Off and you can also exclude users from receiving this policy
Its great to see some more brilliant developments in Conditional Access and really excited to see these go live with customers.
When rolling out a Skype for Business 2015 Front End, I ran into the following issue after running the Deployment Wizard Step 2;
Skype for Business Deployment Wizard Error
Prerequisite not satisfied: Before you install Skype for Business Server 2015, you must install an update for Windows Server 2012 R2. For details about the update, see Microsoft Knowledge Base article 2982006, “IIS crashes occasionally when a request is sent to a default document in Windows 8.1 or Windows Server 2012 R2” at http://go.microsoft.com/fwlink/?LinkId=519376.
At closer investigation of the Deployment Wizard I could see that KB2982006 is missing from the Windows 2012 R2 OS
The operating system was completely up to date with all latest Microsoft Updates, so in this case I used my trusted steed “PowerShell” to check if all the required windows updates where applied for KB2982006
Get-Hotfix KB2919442,KB2919355,KB2982006
This PowerShell command checks for the required KBs as well as the missing KB2982006
The resolution for installing KB2982006 is a simple one but you are required to use Deployment Image Servicing and Management otherwise known as DISM to install the KB
Resolution Steps
Download the KB to a location on your Server, for this Ill be using a temporary folder on the C: Drive called Patch. PLEASE NOTE: The folder must exist before running the below command.
Launch the Windows PowerShell console.
Type the following command; expand -F:* C:\Patch\Windows8.1-KB2982006-x64.msu C:\Patch\KB2982006
Now type the following command; dism.exe /Online /Add-Package /PackagePath:C:\Patch\KB2982006\Windows8.1-KB2982006-x64.cab
If you rerun Get-Hotfix KB2919442,KB2919355,KB2982006 you should now see the KB2982006 hotfix installed.
You will now be able to successfully complete Step 2 of the Deployment Wizard and build your Skype for Business Front End.
I have been recently working on updating a number of my PowerShell scripts and ran into an issue where my variables were unavailable within a function. The resolution for this is making the variables globally available to all the function(s) that are contained within your script.
So, as you can see below. I have configured my script blocks into Functions and converted the Parameter variables into $Global: variables. This will allow the Get-MailMessage function to use the $Global: variables within its own function
Without $Global:With $Global:
However, there is one more step required to ensure that the variables can use the globally defined variables. I have a configure region within my script that contains all my defined variables and in here I have put for example $Global:Variable = $Global:Variable
$Global:Variables = $Global:Variables
As you can see from above image the variables located in New-MailMessage function are not highlighted in yellow.
Tools of the trade
The reason for the highlighted variables within my script, I use a tool called PowerShell ISE http://www.powertheshell.com. There is a slight cost but well worth it if you are regularly building scripts.
