Browse Tag

Office 365

View When You Deleted an Office 365 Group

group1

Introduction

The ability for soft-delete and restore of an Office 365 Group has recently been released. I put together some information about that in my previous post here. Before this restoration was possible, when you deleted an Office 365 Group it was fully gone. Now we have the ability to view Groups that have been deleted and restore them using PowerShell.

The ability to restore was a great but there was a small gap for me when the cmdlets were first rolled out:

  • You have 30 days to restore an Office 365 Group but you didn’t know when an Office 365 Group was deleted. 

This would make building any logic around things like notifications or reporting a challenge as we could not tell which Groups were about to expire. 

This has been resolved by Microsoft and we now have the ability to see the Deleted Date and Time of an Office 365 Group for the 30 days it is retained using PowerShell. 


What you need to know

  • You can only view the deletion date via PowerShell
  • You can only view the deletion date of Groups that are in the pending permanent delete state that stays around for 30 days

Prerequisites:

  • Azure AD PowerShell V2 – Preview 
    • The release of the cmdlets that support Office 365 Group recovery are now available only in the preview cmdlets. 
    • I am writing this using version 2.0.0.110

Viewing when an Office 365 Group was deleted

1 – Connect to Azure AD via PowerShell (ensure you connect to Preview)

2 – Review the Office 365 Groups that have been deleted and when they were deleted

This will sort the Groups by their DeletedDateTime

You are now good to go build something fancy like:

  • Build a report for admins to notify them weekly what Groups are being permanently deleted
  • Build a single page app to surface deleted Groups and allow users to recover them using an Azure Function

Recovering a Deleted Office 365 Group via PowerShell

group1

Introduction

Ever since Office 365 Groups were released which feels like many moons ago now, when it was deleted, it was unrecoverable.  So if you either on purpose or accidentally deleted an Office 365 Group you lost all your data.  You lost your SharePoint site, Planner data, Outlook mailbox…all of it.  There was a checkbox that you had to check in most places letting you know that deletion was permanent.  What began happening though with the proliferation of Groups throughout Office 365 there was a ton of ways and places to delete a Group.  Last time I tried counting there was at least 16 different ways to delete a Group.  That is a ton of places for UI to be just different enough and someone to make a mistake.  This was also a large concern for regulated or very security aware environments.  The ability to discover and recover critical data can be mandatory in these environments.  That means the lack of ability to restore Groups could be a single bottle neck to stop usage of such a helpful technology. 

Thankfully our wait is now no more and we can recover a deleted Office 365 Group.  The message that this was rolling out appeared in Message Centers today and the Office 365 Roadmap has already been updated that this has been launched. 

Here is the announcement on the Tech Community site and the supporting Microsoft Documentation


NOTE: I am writing this right around the launch date of this feature and will try to keep this post updated if anything changes

What you need to know

  • Currently you can only recover them via PowerShell with GUI coming later
  • You have 30 days from the deletion of the Group to recover it, if not it will be permanently deleted
  • You cannot restore a group if a group with the same SMTP address or alias now exists (that new group would have to be deleted first)
  • It could take up to 24 hours to restore in rare cases
  • You can permanently delete a Group within the 30 days 
  • Content that currently gets restored includes:
    • AD Groups Object including properties and members
    • SMTP address
    • Exchange mailbox & calendar
    • SharePoint Online site
    • OneNote notebook hosted on the SPO site
    • Planner
    •  Additionally if you have a connected Microsoft Team or Office 365 Connected Yammer group those can be restored as well

Prerequisites:

  • Azure AD PowerShell V2 – Preview 
    • The release of the cmdlets that support Office 365 Group recovery are now available only in the preview cmdlets. 
    • I am writing this using version 2.0.0.98 

Steps to recover a deleted Office 365 Group

In my example I have a Group called InterestGroup1 which was deleted and can no longer be seen:

1 – Connect to Azure AD via PowerShell (ensure you connect to Preview)

2 – Review the Office 365 Groups that have been deleted and can be recovered 

I included the list of properties in this for visibility to see everything returned in the recoverable Group object.  You only need Get-AzureADMSDeletedGroup,  ”  | select * ”  is not required. 

3 – Select the Group you want to recover and ensure that you selected a group

Replace “ENTER GROUP DISPLAY NAME HERE” with the appropriate name of the Group you want to recover.  I put this together so you just need to enter the Group Display Name instead of copying the GUID but entering just the ID is also valid in the next step.

4 – Recover your Group

You can run the command from step 2 above to review that your Group you are recovering is no longer in the Deleted Group list.

5 – Confirm you Group has been recovered

After some time it will start popping back up in the GUI.


Steps to permanently delete an Office 365 Group

You can also delete a Group that is in the pending 30 day deletion using this process.  This will delete everything and not be recoverable. 

1 – Follow steps 1 through 3 above to connect to Azure AD and get the group you want to recover in the $deletedgroup variable.  

Instead of using the Restore-AzureADMSDeletedDirectoryObject cmdlet use the Remove-AzureADMSDeletedDirectoryObject cmdlet and passing the Group ID.

2 – Review the Office 365 Group has been deleted

 

Automatically Created Office 365 Groups Based on Direct Reports Coming Soon – (Now Limited Release)

group1

UPDATE 3/21/2017 from Microsoft

Microsoft has released a new update to this roll out stating: 

**We listened to your concerns and have decided to limit the rollout of this feature to a smaller set of customers (notified via MC94808) whom we will work with directly to ensure feedback is considered, and the feature has a positive impact. We thank you all for your constructive feedback, we have learned a few lessons and look forward to continued Group innovations in the future.**

So thankfully the voice of the community has been heard and this below information now relates to the original global release.  There was a ton of discussion around this on the MS Tech Community site and on Twitter. 

Here is the new message in the message center:

Now back to the original post with some slight tweaks….


Last Friday an interesting new message that caught me off guard popped up in my message center titled – Auto creation of Direct Reports group in Outlook

Here are the contents of the message:


Auto creation of Direct Reports group in Outlook
MC96611
Published On : March 17, 2017
Expires On : April 28, 2017
 
To help managers collaborate more effectively with their employees, we will automatically create Office 365 Groups containing the manager’s direct reports. Managers can easily update, delete, or modify the group at any time. This message is associated with Office 365 Roadmap ID 78174.
 
How does this affect me?
Beginning April 13th , 2017 We will automatically create direct reports groups in Outlook (leveraging the Office 365 Groups Service) for eligible managers. If you have Office 365 Groups disabled for your tenant, or if the manager in question doesn’t have permission to create groups, then no group will be created.
 
What do I need to prepare for this change?
If you are looking forward to this, there is no action you need to take. Get yourself familiar with Office 365 Groups, update your user training, and notify your helpdesk, as needed. If you would like to leave Office 365 Groups enabled for your organization but turn off direct reports groups creation, we have provided controls to enable and disable. Please click Additional Information to learn more.

Let’s go a little more into this…

At first glance this sounds like a good idea. The part that I disagree with is the auto opting-in of something like this and the very late notice. Normally things exist on the O365 Roadmap for awhile and fall intro their standard development and release cadence. This one is being rolled out within a month of the announcement and doesn’t have info if it will be first-release to start. This feature has the ability to create a whole ton of Groups depending on the size of your organization whether you are ready for them or not. The majority of the large clients I work with have not fully jumped into the Groups world yet and are working towards basic governance, adoption, and training strategies before they fully go. For those organizations, they could already have a plan to provision groups for specific teams – company teams not the product 🙂 – they will most likely get these new Groups created before they are ready. In the documentation currently they don’t list anything for the continued update of groups either. If this is a one time push there will need to be onus on the Managers to maintain their Groups post auto creation. I would still say there are more questions to be answered for this feature and there is already a good discussion on the MS Tech Community site
 
Another thing I noticed is the new naming of this release. The title specifically calls out that these are Groups in “Outlook”. This looks like a new way to refer to Email (Outlook) conversation based Groups vs Yammer conversation based Groups. 
 
As stated above this is no longer going to be rolled out to everyone and will be rolled out to a limited subset of tenants. 

How will the members of the Groups be determined?

The member population of these Groups is based on your Active Directory ManagedBy attribute. As you’re reading this, raise your hand if you think your ManagedBy attribute is accurate enough in you Active Directory environment? Now lower your hand because you are just reading this post and and someone near you might think you have a question. If you have any direct reports (i.e. your name is listed in someone’s ManagedBy attribute) you potentially could have a group auto created. The manager will be added as an Owner of the Group while everyone else will be added as Members. 

How can I control these auto provisioned Groups?

Some key things to note:
  • This is on by default. I felt like I just needed to repeat this one again. 
  • Office 365 Group creation must be enabled at the tenant.  I have highlighted how to manage this in a few posts on here
  • The manager must have the permission and ability to create an Office 365 Group.
  • The group will be named “<Manager’s Name>’s direct reports”, but that can be edited.
  • You can only turn this off via PowerShell and connecting through Exchange Online (unlike Azure AD for other Group management). 

Steps to manage auto provisioning of Direct Reports Office 365 Groups via PowerShell

1 – Connect to Exchange Online via PowerShell

2 – Review your current settings for the parameter “DirectReportsGroupAutoCreationEnabled” using the Get-OrganizationConfig cmdlet. 

 

2 – Set the value of “DirectReportsGroupAutoCreationEnabled” to false to disable auto group creation and true to enable it. Review your change with the same cmdlet above. 

Hide Sync for Sites via PowerShell in SharePoint Online – Offline Client Availablity

Offline Client Availability is built within SharePoint to “Prevent users from downloading content from a site” via MS support.   There is not a way that I am aware of to fully stop existing syncs, but what is capable is to hide the Sync option from the views within the document library.  This setting can be done at the site and the library level.  

When working at the site level, this setting actually exists at the “Web” level within SharePoint.  This means its not a site collection level and needs to be set per site, including all subsites. 


What it looks like when done

This is what you will see with this setting set to NO:

Modern experience (no sync option)

Classic experience (sync option greyed out)


This is what you see with this setting set to YES:

Modern experience

Classic experience


Setting via Browser

The Offline Client Availability option can be set by single site under…

  1. On the site, click Settings > Site Settings.
  2. Under Search, click Search and offline availability.
  3. In the Offline Client Availability section, select No.


 

Setting via PowerShell powershell2

There was a good discussion going on within the MS Tech Community site around the ability to restrict sync via scripting and I tried to put together what I could to support it.  Obviously it would be tedious to try to set that for all sites and subsites across your tenant.  This was my first published attempt for CSOM so I used some great references to get me through it and this is probably rough around the edges.  All feedback is helpful!

Setting this CSOM web property (ExcludeFromOfflineClient) to true does not disable synchronization. Instead, it represents a recommendation to the client not to attempt synchronization via technet.

Ensure that you update the <script path> section near the header with the path to your CSOM files. Ensure you have at least the August 2016 version of CSOM.  Link to latest Nuget for download.

Link to download most recent version of powershell script from TechNet gallery

16235-illustration-of-a-green-download-button-pv


Used helpful references 

So much good info already out there that helped me get started; Thank you!

Get-SPOSite Now Returns Office 365 Group and Video Site Collections

For the longest time it was not possible to see Office 365 Group and Office 365 Video site collections in PowerShell using the SharePoint Online Management Shell and the Get-SPOSite cmdlet.  If you declared the site directly you could see the site.  Also if you used the Set-SPOSite cmdlet to set values of the site it would work but you couldn’t see all sites with one cmdlet.  As of a recent release this is now possible. 

You can also now use a -Template command to limit the query based on the site collection template which will allow you to get only Office 365 Video or Group site collections

Get all Office 365 Group site collections

Get all Office 365 Video site collections