Office 365 Groups Naming Policy

group1

Introduction

When Office 365 Groups were first released there was not an ability to control the names of Groups at all. One of the primary reasons for this was due to the cross workload functionality that make up Office 365 Groups. As a reminder, an Office 365 Group is the single Azure AD identity service that provides specific membership to Office 365 solutions like SharePoint, Exchange, Planner, Teams, etc. Within each of these workloads you have the ability to create and manage an Office 365 Group. If you make a change within one of workloads, for example SharePoint, there is communication between the workload and Azure AD with notifications on things like creation, changes, and deletions. 

With a separated system and Azure AD as the source, any policies need to be applied at the Azure AD level. As an example, an Exchange naming policy can be used (and at one point was the only option) for Office 365 Groups. If you set a naming policy within Exchange that would only work if you tried creating a group within Exchange. If I was on SharePoint Home and tried to create an Office 365 Group that naming policy would not trigger as I technically not working in Exchange. Exchange would learn about the Group after it is synced back to Azure AD but that would be too late. 

To resolve this issue Microsoft has released Office 365 Group naming policy capabilities at the Azure AD level. A naming policy is very important for proper control and a clean Global Address List (GAL). Since this is in Azure AD now the naming policy is applied to Groups that are created across workloads. 

Details

As I am writing this post in Dec 2017 this is currently still in Private Preview. 

Both of these currently can only be configured with PowerShell. The prerequisites for configuring these can be found in this post: Managing Office 365 Groups using Azure AD PowerShell V2.

The AzureADPreview PowerShell module version 2.0.0.137 is required.

Office 365 Group naming policies can be built using 2 different features and 1 is automatically maintained:

  • Custom blocked words
    • You can set specific blocked words that can be used within Group names. 
  • Prefix-Suffix naming policy
    • Using fixed strings or user attributes, you can add an automated prefix or suffix to a Group name. 
  • Microsoft Standard blocked words list
    • A set of words Microsoft manages that are not allowed. This includes your primary swear words. I tested quite a few good ones and they were all blocked automatically.

These administrators bypass or are exempt from the naming polices you configure but NOT the MS standard blocked words list:

  • Global Administrator
  • Partner Tier 1 Support
  • Partner Tier 2 Support
  • User Account Administrator
  • Directory Writers

Microsoft detailed information for the naming policy can be found here.


Custom blocked words

This is a comma separated list of words that you can configure. These words are blocked in Group names and aliases. Some examples of when you would want to configure blocked words:

  • Your department or business function names because you want to ensure you don’t have duplicate places for content
  • Regulatory words that you may have specific legal requirements around that you need to have more control over
  • Names of roles that you don’t want people to try to impersonate
  • Client, Vendor, or Competitor names

There are some things to know about these blocked words.

  • The checks are done AFTER appending the prefix/suffix to the Group name
    • If things like underscores (_) or dashes (-) are used in prefix/suffix they could stop your blocked word from working if there are no spaces
  • No sub-string searches are done
    • If “Drew” is the blocked word, “Andrew” would still work
  • Not case-sensitive
  • No character restrictions
  • No limit on the amount of words

Steps to set the Custom Blocked words

This is assuming you already have a directory settings template created, details in prior post, and connection information from the first section.

1 – Connect to Azure AD via PowerShell.

2 – Use comma delimited values for the blocked words.

3 – Review your updated settings; you can now see the default values for the directory settings object.


Prefix-Suffix naming policy

These can either be fixed strings or actually attributes from the user themselves. These 2 types of capabilities are stored within 1 overall string that is concatenated. Because of this, you must always have [GroupName] included in your setting. That is how you are able to have a prefix & a suffix. 

Some examples of using strings:

  • GRP [GroupName]
    • This puts the fixed string of “GRP ” before all of your Group names
  • #[GroupName] Group
    • This will put the # symbol at the front of the Group name for better sorting in the GAL and then ” Group” as a suffix for better clarity
    • Special characters are removed from the Alias
  • OGRP – [GroupName]
    • Dashes can be used for separation as spaces are removed automatically in the Group Alias (like the rest of the special characters). That means “OGRP – Drew” as a group name becomes “OGRP-Drew@domain.com” as the alias instead of “OGRPDrew@domain.com”.

The next type of thing you can add are Azure AD user attributes. The following attributes are supported: [Department], [Company], [Office], [StateOrProvince], [CountryOrRegion], [Title], [CountryCode]

Some examples of using attributes:

  • [Department] – [GroupName]
    • This will pull the users department stored in Azure AD before the Group name
  • [CountryCode] – GRP – [GroupName]
    • This will first put the Country Code stored in Azure AD followed by a fixed string and then the Group name

There are some things to know about using attributes.

  • The total prefix/suffix + string length is restricted to 53 characters
  • Empty attributes for users will be filled in with blank values. It is best to ensure your Azure AD information is fully established before using these attributes.
  • Extension attributes and custom attributes are not supported
    • If you put it in an unsupported attribute it just comes across as text

Steps to set the Prefix – Suffix naming policy

This is assuming you already have a directory settings template created, details in prior post.

1 – Use comma delimited values for the blocked words.

2 – Review your updated settings; you can now see the default values for the directory settings object.


Microsoft standard blocked words

There are a lot of unprofessional words naturally in the English language that most likely should never be part of an Office 365 Group name. This includes a primary set of things like swear words and other inappropriate words that your imagination may be able to come up with. This is a single setting to turn on the blocked words or off. 

Steps to set the Microsoft blocked words

This is assuming you already have a directory settings template created, details in prior post, and connection information from the first section.

1 – Use comma delimited values for the blocked words.

2 – Review your updated settings; you can now see the default values for the directory settings object.


And when you put it all together!

You get a blocked word of CEO and a naming policy pulling in a prefix of “GRP – ” with an Azure AD department of “NFL” and a suffix of ” – CEO”. You will also see the alias removing the spaces.


Where does the naming policy actually work?

As there are a lot of workloads across Office 365 that utilize Groups there are a lot of places that these policies need to work. Currently it is not supported in every workload. Microsoft has the detailed information for what is supported in their support article here

Here is the current breakdown in Dec 2017.

Where it works:

  • Outlook on the Web
  • Outlook Client – Doesn’t preview
  • Outlook Mobile – Doesn’t preview
  • Teams
  • SharePoint
  • Stream
  • Groups mobile app
  • Planner
  • Dynamics 365
  • Exchange PowerShell
  • Azure AD PowerShell
  • O365 Admin Center

Where it doesn’t:

  • Power BI workspace
  • Yammer
  • StaffHub
  • Azure AD Portal

Licensing

Any Office 365 subscription that has Exchange Online and SharePoint Online will support groups. That includes the Business Essentials and Business Premium plans, and the Enterprise E1, E3 and E5 plans.

There is a large collection of features that require specific types of Azure AD licenses. The Office 365 Groups naming policy requires Azure AD Premium P1 licenses for any users who are part of Office 365 Groups.

The full collection of licensing information is listed from Microsoft here.

Speaking about OneDrive at the Collab365 Global Conference

Have you heard about the virtual Collab365 Global Conference 2017 that’s streaming online November 1st – 2nd?

Join me and 120 other speakers from around the world who will be bringing you the very latest content around SharePoint, Office 365, Flow, PowerApps, Azure, OneDrive for Business and of course the increasingly popular Microsoft Teams. The event is produced by the Collab365 Community and is entirely free to attend.

Places are limited to 5000 so be quick and register now.

During the conference I’d love you to watch my session which is called : ‘What’s New with OneDrive for Business’

Have you seen all the new features in OneDrive for Business (OD4B) lately? Are you getting ready to roll-out OD4B to your enterprise? Or are you just looking to see what you’re missing if you aren’t on OD4B yet? OneDrive for Business in Office 365 is changing quickly and we as end-users and IT professionals need to try keep up. Join me as we walk through the newest improvements to the world of OneDrive for Business in Office 365. This session will be demo filled and by the end you will see the investment and dedication that Microsoft has too provide a solid personal file solution.​

If you join me, you will learn:

  • New features in OD4B.
  • What’s coming next in OD4B?
  • What does the current experience look like?

Topic(s):

  • OneDrive

Audience :

  • End User
  • IT Architect

Time (in UTC) :

  • Thursday, November 2 2017 12:00 AM

How to attend :

  1. Register here.
  2. At the time listed above go here to watch my session. (you can also add me to your own personal planner from the agenda.
  3. Be ready to take notes!

SharePoint, OneDrive & Office 365 Collaboration Announcements from Ignite 2017

I will be keeping track of all of the announcements that I can keep up with around SharePoint, OneDrive, and the Office 365 collaboration space at Microsoft Ignite next week using Sway. Since I am using Sway you will be seeing my updates live as I type and publish them.  That means this will be an evergreen Sway and hopefully a 1 stop shop for anyone looking to catch up on all the great news coming out of Ignite. 

 

Speaking at Microsoft Ignite

One of the biggest Microsoft events is just around the corner down in Orlando, Florida. Microsoft Ignite is the conglomerate of smaller technology specific events like the SharePoint Conference and TechEd. It is the yearly gathering for IT professionals and really anyone working with Microsoft to learn about the new modern solutions that are being released and what is next. It also is one of the best times to network and consult with other experts from around the world. Hopefully through keynote, breakout, and community sessions you will learn where you should be concentrating your learning efforts moving forward. 

Personally I have been lucky to attend both of previous Microsoft Ignites (2015 & 2016) along with previous Microsoft SharePoint Conferences. This year I am honored to be selected to speak at Ignite 2017.  This will be my first time speaking at either Ignite or a previous SPC. 

My session info & link:

  • Title: Can I get a side of OneDrive for Business with my SharePoint?
  • Description: When working with Microsoft collaboration tools there is always a lot of conversation about what to use when. SharePoint and OneDrive for Business are best served together in Office 365. In this session, we walk through OneDrive for Business and the capabilities for collaboration and how they relate to your overall SharePoint solution.
  • Date: Tuesday, September 26th at 5:05 p.m. 
  • Location: OCCC South – Expo Theater #1
  • Link to files & conversation in Tech Community

I am hoping during my session I can speak to a lot of the great things that Microsoft already has out there in the OneDrive & SharePoint space and real-world scenarios of how they are best used together.   I work with a lot of clients in Office 365 across a lot of industries and of all sizes.  I have seen a lot of successful Office 365 collaboration implementations and some that I know could be better.  I will be be going through such things as how and when you should be using OneDrive vs SharePoint along with common scenarios of when to use each.  By the end I hope to shed some light on things that you can take home with you to help ensure the best Office 365 adoption you can get while utilizing the appropriate solutions. 

As I am writing this the week before Ignite, I am already past 475 registered attendees for this session and can’t wait to see where we go from there. I also can’t wait to get down to Orlando and see some familiar faces and hopefully make some new friends whether at the event or at the always fun after parties.  If you see my walking around or sitting aimlessly by myself come on over and let’s chat!  See everyone soon!

View When You Deleted an Office 365 Group

group1

Introduction

The ability for soft-delete and restore of an Office 365 Group has recently been released. I put together some information about that in my previous post here. Before this restoration was possible, when you deleted an Office 365 Group it was fully gone. Now we have the ability to view Groups that have been deleted and restore them using PowerShell.

The ability to restore was a great but there was a small gap for me when the cmdlets were first rolled out:

  • You have 30 days to restore an Office 365 Group but you didn’t know when an Office 365 Group was deleted. 

This would make building any logic around things like notifications or reporting a challenge as we could not tell which Groups were about to expire. 

This has been resolved by Microsoft and we now have the ability to see the Deleted Date and Time of an Office 365 Group for the 30 days it is retained using PowerShell. 


What you need to know

  • You can only view the deletion date via PowerShell
  • You can only view the deletion date of Groups that are in the pending permanent delete state that stays around for 30 days

Prerequisites:

  • Azure AD PowerShell V2 – Preview 
    • The release of the cmdlets that support Office 365 Group recovery are now available only in the preview cmdlets. 
    • I am writing this using version 2.0.0.110

Viewing when an Office 365 Group was deleted

1 – Connect to Azure AD via PowerShell (ensure you connect to Preview)

2 – Review the Office 365 Groups that have been deleted and when they were deleted

This will sort the Groups by their DeletedDateTime

You are now good to go build something fancy like:

  • Build a report for admins to notify them weekly what Groups are being permanently deleted
  • Build a single page app to surface deleted Groups and allow users to recover them using an Azure Function