Microsoft 365

Delete Microsoft 365 Tenant

Delete Microsoft 365 Tenant

There are various reasons why you may need to delete a Microsoft 365 tenant. The most common one I run into is after a corporate merger or acquisition. In this post, I will show step-by-step how to delete a Microsoft 365 tenant.

Prerequisites

  • All invoices are paid
  • All domains are removed other than the CompanyName.onmicrosoft.com domain name
  • All users are deleted and deleted from deleted users except for one Global Admin.
  • All App registration and Enterprise applications are deleted.
  • No Azure subscriptions.
  • All licenses are deleted and removed.

Completing all of those perquisites will take time and sometimes things are stuck but it is possible to complete all of them.

The Process

  • Login to Entra admin center
  • Click on Identity > Overview
  • Click on Manage tenants
  • Select the tenant and click Delete
  • It will check if the tenant can be deleted.
…

Read More Read More

Control Microsoft 365 Group Creation

Control Microsoft 365 Group Creation

Controlling who can and can’t create Microsoft 365 groups can be a very powerful tool. In this post, I will detail step-by-step how to prevent users from creating Microsoft 365 groups unless they are members of a specific security group.

Prerequisites

  • Microsoft Entra ID P1 or P2 is needed for the users who are allowed to create groups. (The old name was Azure Active Directory Premium P1 or P2)
  • Microsoft Graph Beta Installed.

The Process

  • Login to Microsoft Entra admin center
  • Click on Groups > All Groups
  • Click on New group
  • Make sure the Group type is set to Security.
  • Give your group a name. In my example, I will use the name Group Creators.
  • Add anyone that you want to have the power to create Microsoft 365 Groups to the security group you just created.
  • Open PowerShell ISE.
  • Copy the script from Microsoft here.
  • On line 6 enter the name of the security group you just created. In my case, that group is called Group Creators.

The beginning of the script should look something like this.

Import-Module Microsoft.Graph.Beta.Identity.DirectoryManagement
Import-Module Microsoft.Graph.Beta.Groups

Connect-MgGraph -Scopes "Directory.ReadWrite.All", "Group.Read.All"

$GroupName = "Group Creators"
$AllowGroupCreation = "False"

$settingsObjectID = (Get-MgBetaDirectorySetting | Where-object -Property Displayname -Value "Group.Unified" -EQ).id
Code language: PowerShell (powershell)
…

Read More Read More

Microsoft 365 Report Message Button

Microsoft 365 Report Message Button

Providing your users with a centralized and user-friendly way to report phishing, junk, and non-junk emails is a great quality-of-life improvement for everyone.

In this post, I’ll cover step-by-step how to deploy the Microsoft Report Message add-in for Microsoft Outlook with Microsoft 365.

  • Login to the Microsoft 365 admin center.
  • Click on Settings > Integrated apps
  • Click on Get apps
  • Search for Report Message
…

Read More Read More

Swap Microsoft 365 Licenses with Microsoft Graph

Swap Microsoft 365 Licenses with Microsoft Graph

A few years ago I wrote a post about how to Swap Office 365 Licenses. Microsoft has deprecated the cmdlets that were used in that post specifically Set-MsolUserLicense and has replaced them with Microsoft Graph cmdlets specifically Set-MgUserLicense.

In this post, I will show step-by-step how to swap Microsoft 365 licenses using Microsoft Graph and PowerShell.

Prerequisites

The Process

We need a few more permissions than the default permissions for Microsoft Graph.

  • Run the following command to connect Microsoft Graph to your Microsoft 365 tenant with the necessary permissions Connect-MgGraph -Scopes User.ReadWrite.All, Organization.Read.All

Now let’s find out what SKUs we have to work with.

  • Run the following command to get the list of SKUs in your Microsoft 365 tenant Get-MgSubscribedSku -All | select SkuPartNumber

If you aren’t sure what product the SKU correlates to Microsoft has made a decoder ring, you can find that here.

Now for the license swap part, I’ve created a PowerShell script to do it.

…

Read More Read More

Microsoft 365 Setup Microsoft Graph PowerShell SDK

Microsoft 365 Setup Microsoft Graph PowerShell SDK

Microsoft has been warning about the deprecation of the MS Online and Azure AD PowerShell cmdlets for a while now; the end date is fast approaching, and some of the commands have stopped working. You can read the Microsoft post about the deprecation here.

Microsoft Graph is becoming a day-to-day reality and a tool we’ll need to use to manage items in Microsoft 365 with PowerShell.

In this post, I’ll cover step-by-step how to setup the Microsoft Graph PowerShell SDK to connect to a Microsoft 365 tenant and show how it works and how to secure it.

Installing

To get started with Microsoft Graph we first need to install it.

  • Open PowerShell as Admin
  • Install Microsoft Graph PowerShell SDK by running the command Install-Module Microsoft.Graph

Connecting

Now that the Microsoft Graph is installed we can connect to a Microsoft 365 tenant.

  • Run the following PowerShell command to connect to a Microsoft 365 tenant Connect-MgGraph
  • Login with a Global Admin account.

You will now see a screen that lists the permissions that Microsoft Graph needs to function.

Microsoft Graph permissions
  • Select Consent on behalf of your organization and click Accept

It is normal that the Microsoft Graph Command Line Tools shows up as unverified, there is a long-standing issue on GitHub about it. You can read more about Issue #482 on GitHub.

Now you are connected to the Microsoft 365 tenant and can run Microsoft Graph cmdlets.

How it works

I got curious about why the application permissions are needed and what is happening. Here’s what I found out.

When you click Accept it creates an enterprise application in Microsoft Entra ID (Azure AD) named Microsoft Graph Command Line Tools and has an Application ID of 14d82eec-204b-4c2f-b7e8-296a70dab67e and grants the app delegate permission to the permissions that were listed. By selecting Consent on behalf of your organization allows the app to not have to ask for the permissions every time you use it.

…

Read More Read More

Windows Search Box Company Branding

Windows Search Box Company Branding

A while back I saw someone’s computer that had a company logo in the Windows taskbar; it looked super slick. I wanted to duplicate the same thing in my setup.

The documentation on what causes a company logo to show up in the search box in the Windows taskbar and the Windows start menu is kind of lacking however, after playing around I figured it out. It’s the custom default theme in Microsoft 365 that will cause the organization logo to show up on Windows devices connected to a Microsoft 365 tenant be it joined or just registered devices.

Before and after adding the company logo branding

In this post, I will show step-by-step how to add a custom default theme to your Microsoft 365 tenant that will also apply to the search box in the taskbar of Windows devices. This works on Windows 10 and Windows 11.

The Process

  • Login to the Microsoft 365 admin center
  • Click on Settings > Org settings
  • Click Organization profile
…

Read More Read More

Microsoft 365 Enable DKIM

Microsoft 365 Enable DKIM

DKIM (DomainKeys Identified Mail) is a way to help validate the authenticity of the emails you send.

DKIM adds a signature to your email by using a private key and a public key. Your public key is your DKIM DNS record and only your email server knows your private key. When you have DKIM setup every email you send gets signed with DKIM.

A DKIM signature is built from the hashed values of some of the email headers, one of which is the hash of the email body itself. With the hashed value of the email headers, DKIM encrypts it by using a private key and a public key and adds the encrypted result to the email as a DKIM header signature. This is similar to how PGP works. If you want to know more about PGP you can read more in my post about PGP.

When the recipient receives an email that was signed with DKIM, the recipient’s email server can validate that the email hasn’t been tampered with by decrypting the DKIM header signature using the sender’s public key. If the message was altered the DKIM header signature wouldn’t exist or the decrypted result wouldn’t match.

In this post, I will detail step-by-step how to enable DKIM on a Microsoft 365 tenant by using the GUI and PowerShell.

GUI Way

  • Login to Microsoft 365 admin center
  • Click on Security
  • Click on Policies & rules
  • Click on Threat policies
…

Read More Read More

Microsoft 365 Exchange Online 150 MB Message Size

Microsoft 365 Exchange Online 150 MB Message Size

Back in 2015, Microsoft enabled all Microsoft 365 (aka Office 365) Exchange Online tenants the ability to change their message sizes to a maximum size of 150 MB. Originally the default size was 25 MB and previously Microsoft increased that to 35 MB, your tenant will likely be set to one of those values.

The new 150 MB message size limit is not enabled by default you must enable it. In this post, I will detail step-by-step how to change the message size limit in Exchange Online for all existing mailboxes and all new mailboxes.

Prerequisites

The Process

  • Connect to Exchange Online with PowerShell
  • Run the following PowerShell command to see what the current message size limit is Get-Mailbox -Resultsize Unlimited | Format-List displayname,MaxSendSize,MaxReceiveSize
Checking the current message size limit
  • Run the following PowerShell command to set all existing mailboxes to 150 MB Get-Mailbox -Resultsize Unlimited | Set-Mailbox -MaxReceiveSize 150MB -MaxSendSize 150MB
Increasing the message size limit
…

Read More Read More

Microsoft 365 Audit Logging

Microsoft 365 Audit Logging

For whatever reason the default fresh setup of Microsoft 365 has no audit logging turned on. Audit logging is very useful for IT troubleshooting and auditors love logs.

Microsoft says that it is enabled by default for Microsoft 365 and Office 365 enterprise organizations. I suspect that means only if you have E1 or higher. The new tenants I’ve made recently are not E1 or higher, that could be why I didn’t see it already on.

Someone asked for clarification about this on GitHub however the replies all say that it is on by default for everything but that isn’t true based on my experience. You can read the GitHub issue here.

Microsoft’s documentation also says to double check that audit logging is enabled which you 100% should be doing as if it’s on or not seems inconcistant.

In this post I will detail how to check if audit logging is enabled and how to enable it via the Web UI or PowerShell.

Prerequisites

The Web UI Way

  • Login to Microsoft 365 Admin center.
  • Click on Security or Compliance (you can get to auditing from either one)
  • From the Security or Compliance admin centers click on Audit

If audit logging isn’t enable the page will look something like this.

  • Click on Start recording user and admin activity

Audit Logging is now enabled it may take a bit for it to actually start working.

The PowerShell Way

  • Connect to Exchange Online with PowerShell
  • Run the following command to check if Audit Logging is enabled Get-AdminAuditLogConfig | FL UnifiedAuditLogIngestionEnabled

In my example the returned result is false so audit logging isn’t enabled and we want to turn that on.

…

Read More Read More

Microsoft 365 Enable Organization Customization

Microsoft 365 Enable Organization Customization

Right out of the box the initial configuration of Microsoft 365 (aka Office 365) isn’t bad, but there’s a lot more you can do to harden it and to make it fully yours.

By default all Microsoft 365 tenants are in a state that is called dehydrated. Microsoft places all the tenants in this state in order to save space, as there are likely many Microsoft 365 tenants that will never change anything past the defaults, but that’s no fun.

In order to rehydrate our Microsoft 365 tenant to allow for a whole number of customizations we need to enable something that is called organization customizations.

Once we have enabled organization customizations we will be able to customize a lot more things in our Microsoft 365 tenant.

Here’s how to do that.

The Process

  • Connect to Exchange Online with PowerShell
  • Double check the hydration status of your Microsoft 365 tenant by running the following command Get-OrganizationConfig | FL isDehydrated
…

Read More Read More