Managing Office 365 Group Creation via Azure AD

group1

Introduction

Nearly every time Microsoft introduces a solution in Office 365 one of the first thing IT people look for is how to turn it off. The same thing occurred when Office 365 Groups were released to the world. Office 365 Groups are more unique in this situation because they are not really a single technology but more of a solution wrapping multiple technologies within Office 365. There are a lot of other posts out there about what actually makes up Office 365 Groups and I plan to write a much longer one, but here are the basics of what is currently wrapped up:

  • Email & Calendar
  • Security & Membership
  • Files & OneNote
  • Planner
  • PowerBI
  • and more!

One key thing to understand looking at this list is that you have multiple technologies such as Azure AD, Exchange, and SharePoint. When you have multiple technologies you have a harder challenge with centralized management. As Microsoft continues to innovate they will continue to do so using the Minimal Viable Product (MVP) method. This means that we are getting solutions that are not fully developed and one of the most common areas that this is lacking is with IT management. New solutions are people first and personally I like this approach.

What occurred with Office 365 Groups was that until very recently the only way to control Group creation was through Outlook Mailbox Policies via Exchange. This meant that if you created a group via Planner (which Groups are required) or PowerBI it would not follow the policy and the user could still create Groups. This is because the creation is not occurring through an Exchange application and means the OwaMailboxPolicy process doesn’t work anymore.


Managing Group Creation via Azure AD

With the GA of Planner, Microsoft added the ability within Azure AD PowerShell to control who can create Office 365 Groups. This process is no longer dependent on Exchange so it passes throughout Office 365. If an OWA policy exists and Azure AD (AAD) policy is enabled, the OWA policy will be ignored.

You can now do 2 things:

  1. Disable the default ability of everyone to create a new Office 365 Group
  2. Point to an AAD group (Office 365 Group or Distribution Group) that contains a list of people who are allowed to create groups
    • This group cannot have a group in it, must be individual users
    • Users with higher tenant roles already have access (company admin, mailbox admin, etc…)

Prerequisites:

NOTE: Version 1.1.143.0 of the Azure AD PowerShell module includes many changes to renew the existing MSOL PowerShell cmdets. Over time the existing MSOL cmdlets will be replaced. The new module is called “AzureAD.” So where e.g. an existing cmdlet was named “New-MSOLUser”, which adds a new user to the directory, the new cmdlet’s name is “New-AzureADUser.

My scripts below are using Version 1.1.143.0.  Azure AD PowerShell Module Version Release History


Steps to disable ALL Group creation

1 – Connect to Azure AD via PowerShell

2 – Review if you have any MsolSettings currently configured in your tenant

3a – If you have settings returned it will look like this (properties subject to change over time)

group2

Run this command to set EnableGroupCreation to false and remove any groups entered in GroupCreationAllowedGroupId

3b – If you have NO settings returned it will look like this a new template will need to be created

group3

Run this command to create the new template with EnableGroupCreation set to false

4 – Review your updated settings; now Group creation is disabled for all users

group4


Steps to disable Group creation except for only authorized users

1 – Connect to Azure AD via PowerShell

2 – Review if you have any MsolSettings currently configured in your tenant

3a – If you have settings returned it will look like this (properties subject to change over time)

group2

Run this command to update the settings with EnableGroupCreation set to false and pass the group for authorized users who will be able to create groups.

  • Replace “ENTER GROUP DISPLAY NAME HERE” with the display name of your group to get the ObjectId of the group.

Here is a visual example of what we are trying to get via the Azure AD portal.

group5

3b – If you have NO settings returned it will look like this a new template will need to be created

group3

Run this command to create the new template with EnableGroupCreation set to false and pass the group for authorized users who will be able to create groups.

  • Replace “ENTER GROUP DISPLAY NAME HERE” with the display name of your group to get the ObjectId of the group.

4 – Review your updated settings; now Group creation is disabled for all users EXCEPT the ones in the declared group

group6


Aftermath

Once configured users will see errors like this when trying to create an Office 365 Group

Via Outlook UI:

group8

Via Planner UI:

group7

All of these Office 365 Group scripts can be found on Github. Large thanks to Tony Redmond, Santhosh Balakrishnan, and Juan Carlos Martin for providing multiple scripts

Please feel free to contribute!

https://github.com/dmadelung/O365GroupsScripts

SPTechCon Boston Slides & Scripts

sptechcon

Thanks to all who joined my session at SPTechCon Boston.  This was my first SPTechCon event and look forward to speaking/attending again.  The conference was ran great and had a great selection of content.  I did a presentation on a deep dive into Office 365 Groups.  I went through some high level management topics and then went deep into Powershell administration options. I put all of the scripts that I discussed onto Github so people can help contribute.  I will be trying add to this project as I find new handy scripts.

Here are the links to the slides and the slides and the scripts:

Scripts:     http://bit.ly/DrewO365GroupScripts

Slides:      http://bit.ly/DrewO365GroupsSlides


Here is my session abstract:

Office 365 Groups enable teams to work together by establishing a single identity in Office 365. Office 365 Groups are a new and modern solution for collaboration in Office 365. There is a lot of confusion on what Groups can do and should be used for. This session will be a deep dive into all things Office 365 Groups focusing on the technical aspects..
We will spend a large amount of this session demoing Office 365 Groups. This session will include demos of:

  • How to create, access, and navigate
  • What are the core things to do
  • How are they technically structured
  • What administration is available and how to do it
  • What extensibility options are there

I will also walk through the pros and cons of using Groups vs other collaboration options in Office 365. Groups are also one of the fastest changing solutions in Office 365, so this session will bring everyone up to speed on the most recent updates that Microsoft has rolled out and what innovations are next. By the end of the session you should have a better understanding of what Groups can do and if they are right for your enterprise right now or in the future!

Disabling Office 365 Planner Using PowerShell

Office 365 Planner is now rolling out to your tenant.  Microsoft announced this week that Planner is ready for showtime. As this is a product early in its life cycle, Microsoft is still looking for feedback through the Planner uservoice site. Over the next several weeks, Planner will roll out to all eligible Office 365 customers worldwide. At this time, Planner is included with:

  • Office 365 Enterprise (E1, E3, E4, and E5)
  • Office 365 Education (E1, E3, E4, and E5)
  • Office 365 Business Essentials
  • Office 365 Business Premium.

Microsoft Planner will not be available to users by default in the General Availability (GA) update in the following subscription plans:

  • Office 365 operated by 21Vianet
  • Office 365 Government

An important thing to note with this release…

Each user who has one of the Office 365 plans mentioned above has a Microsoft Planner license that is enabled by default.

If your enterprise is not ready, an admin can add or remove licenses for individual users, or to disable Planner to all users. I put a script together that you can run to disable Planner for all licensed users in your tenant.  This script will:

  1. Disable any plan entered into the $disabledplans variable, by default it is just Planner (PROJECTWORKMANAGEMENT)
  2. Disable the Planner Preview SKU if it was assigned
  3. ***Reassign all other services not declared as being disabled.*** <- important  
    • Add any other services you want to disable in the $disabledplans variable (i.e. YAMMER_ENTERPRISE)

Thanks to @vladcatrinescu and his script on disabling Yammer as a starting point

Adding and Removing Videos from the Office 365 Video Spotlight

The landing page of the Office 365 Video Portal has a top section dedicated to “Spotlight” videos. You can also choose channels to spotlight on the landing page. You can spotlight up to four videos and three channels on the portal home page. You want to use this section to highlight important videos for your organization. All of these videos are maintained manually by users who have the Video admin permission.

2016-05-23 14_29_24-Video

Adding a video to the spotlight is very straightforward but removing it is not as intuitive.

Steps to add a spotlight video

1)  Navigate to your Office 365 Video Portal landing page

2016-04-22 10_34_40-Settings

2)  Click on Portal Settings in the toolbar

2016-04-22 10_37_29-Settings

3)  Click on the Spotlight section in the left navigation

2016-05-23 14_40_32-Video portal settings

4)  Under the Spotlight videos section click on a section you want to add the video to

2016-05-23 14_42_20-Video portal settings

5)  Select the video you want to add and click OK (there may be a delay if you just uploaded the video as it needs to be indexed by search first)

2016-05-23 14_43_54-Video portal settings

6)  Click Save

2016-05-23 14_45_48-Video portal settings

Steps to remove a spotlight video

1)  Navigate to your Office 365 Video Portal landing page

2016-04-22 10_34_40-Settings

2) Click on Portal Settings in the toolbar

2016-04-22 10_37_29-Settings

3)  Click on the Spotlight section in the left navigation

2016-05-23 14_40_32-Video portal settings

4)  Click on the Video you want to remove under the Spotlight videos section

2016-05-23 14_47_47-Video portal settings

5)  DON’T select any video and JUST click OK

2016-05-23 14_48_44-Video portal settings

6)  You will see the spotlight video section is now empty. Click Save and the landing page will be updated.

2016-05-23 14_49_44-Video portal settings

SharePoint Saturday Nashville Slides

Thank you all who joined me at SPS Nasvhille! It was a great event with a great turnout. A big thanks to the team who helped put this together. I will definitely be looking forward to coming back here for more events. If anyone has any further questions on groups feel free to reach out.

If you want a direct link to download files they can be accessed here:

http://bit.ly/SPSNashvilleGroups

A link to the SlideShare is here: