Author: Adam Fowler

Managing Unified Messaging Users in Exchange Online

Posted on October 18, 2019October 20, 2020 by Adam Fowler

error
The phone number you entered has already been registered by someone else.

This is the standard error you’ll see in the Exchange admin center when trying to enable Unified Messaging on an extension that already has it enabled.

When a user departs you’d expect that when you change the user mailbox to a shared mailbox and drop the licensing, Unified Messaging should go. However, in Exchange Online the mailbox will still be Unified Messaging (UM) enabled, and hang onto the extension it had.

You probably won’t even notice this until you go to enable UM on another mailbox using that same extension, which leads to the error at the top of this article.

The first challenge is to find the Shared Mailbox that is holding onto the extension. After connecting to Exchange Online in PowerShell, you can run this command:

get-ummailbox | select name, phonenumber | out-gridview

This will show a nice gridview of all your mailboxes and what UM extension they have. You can search/filter this view to find the cuplrit.

If you want to see which of your mailboxes are Shared and have UM enabled, run this command:

Get-Mailbox -RecipientTypeDetails SharedMailbox -ResultSize:Unlimited -filter {umenabled -eq "true"}

Knowing this mailbox, you’d expect it should be easy to turn off UM. This wouldn’t be too much of a problem if you could just disable UM like you can on a normal mailbox, but in Exchange admin center this isn’t an option at all when it’s a shared mailbox.

Trying to disable UM via PowerShell with the ‘Disable-UMMailbox’ command also won’t work, as you’ll get a license error:

License validation error: the action 'Disable-UMMailbox', 'Identity', can't be performed on the user 'Test User'
 with license 'BPOS_S_Standard'.
     + CategoryInfo          : NotSpecified: (:) [Disable-UMMailbox], RuleValidationException
     + FullyQualifiedErrorId : [Server=SYXPR01MB1901,RequestId=dfc62192-8270-4a65-b582-c7f327d6e7e2,TimeStamp=15/10/201
    9 6:24:33 AM] [FailureCategory=Cmdlet-RuleValidationException] DDB44050,Microsoft.Exchange.Management.Tasks.UM.Dis
   ableUMMailbox
     + PSComputerName        : outlook.office365.com

To fix this, you could use the Exchange admin center GUI along with the Microsoft 365 Portal, but it’s easier to run all the steps required via PowerShell:

First apply a license to the shared mailbox account that includes Exchange Online. You can see what licenses are available to you with this PowerShell command used by the MsolService cmdlet:

 Get-MsolAccountSku

Then, apply a license with this command against the shared mailbox and the AccountSkuID from the previous command:

Set-MsolUserLicense -UserPrincipalName "UPN OF SHARED MAILBOX" -AddLicenses "tenant:licensename"

Once applied, you’ll then need to change the mailbox to a Regular mailbox rather than Shared:

Set-Mailbox "UPN OF SHARED MAILBOX" -Type Regular

After a while, Unified Messaging may drop off by itself if you allocated a license that doesn’t support it (such as Exchange Online Plan 1 or Exchange Online Kiosk, or you can force it off with this command:

Disable-UMMailbox -Identity  "UPN OF SHARED MAILBOX"

Finally you can now enable UM on that other mailbox that was getting the error on the extension being in use. Easily done via the Exchange admin center GUI.

Two last steps are then to reverse what you did – take the license away from the shared mailbox, and make it a shared mailbox again:

Set-MsolUserLicense -UserPrincipalName "UPN OF SHARED MAILBOX" -RemoveLicenses "tenant:licensename"

Set-Mailbox "UPN OF SHARED MAILBOX" -Type Shared

Blocking ActiveSync with Conditional Access

Posted on September 27, 2019October 20, 2020 by Adam Fowler

Microsoft has announced that they’re continuing the path away from Legacy Authentication, with the decommission of legacy auth to EWS on Exchange Online on October 13th 2020. Instead of waiting for that looming date, there’s a bunch of security reasons to only have Modern Authentication for Microsoft 365.

I’ve already written up on Protect Your Office 365 Accounts By Disabling Basic Authentication and Blocking Legacy Authentication – Conditional Access vs Authentication Policies – but when I migrated from Authentication Policies to Conditional Access, I didn’t realise ActiveSync wasn’t included as part of blocking Legacy Authentication, even though it connects without MFA.

The guide from Microsoft on how to block Legacy Authentication doesn’t actually mention ActiveSync, so it’s easy to miss like I initially did! You’ll need to block ActiveSync altogether as far as I know, as it doesn’t support MFA.

Although I still think Conditional Access is easier to manage than Authentication Policies, there is one caveat; even with an ActiveSync block in place via Conditional Access, too many attempts by a user will lock their account briefly. This might cause problems or require work to get those users to clean up whatever device is trying to log in. With an Authentication Policy I don’t believe this happens because it’s blocked earlier in the sign-in process – you won’t see logs, and the account can’t get locked.

There is of course, a checkbox around ActiveSync, and a way to block it using Conditional Access, but I had mixed results in blocking it successfully until I did it exactly this way:

Create a new Conditional Access Policy and set these options:

Cloud apps or actions > Select Apps > Office 365 Exchange Online

Conditions > Client apps > Tick both ‘Mobile apps and desktop clients’ + ‘Exchange ActiveSync Clients’

In the Users and Groups section, you can narrow this down from ‘All Users’ for testing or for a gradual rollout.

The user experience is interesting on this one – they can still sort of authenticate, but instead of getting their emails, they will see a single email advising that their access has been blocked:

On top of this, you can use Azure AD to audit who might be using ActiveSync before you put any sort of block in place. As per usual, there’s a good Microsoft article on Discovering and blocking legacy authentication which can walk you through this, but in short:

Via the Azure Portal, go to Azure Active Directory > Users. Under Activity, go to Sign-ins. Click Add filters, and choose Client App > Tick the three ‘Exchange ActiveSync’ options and press ‘Apply’. You’ll see the last 7 days of sign in attempts using ActiveSync, which should give you an idea of how many users are using it, and who.

Blocking Legacy Authentication, plus blocking ActiveSync will give you a much more secure environment, protecting from account attacks.

MyAnalytics is Coming (for the rest of us)

Posted on September 19, 2019October 20, 2020 by Adam Fowler

MyAnalytics is an extension to Microsoft 365 which provides productivity insights. It looks at what you do over email, OneDrive for Business and Skype for Business Online/Teams, and collates the data to present it with statistics.

The documentation for how this product works is quite good and worth a read. There’s privacy considerations in any product that’s scraping data, but they seem fairly well addressed. Two main points are that the data for MyAnalytics is processed and stored in the user’s Exchange Online mailbox, and nobody but the user can see this data (including system administrators).

MyAnalytics has been around for a while, but mostly for Office 365 E5 / Microsoft 365 E5 customers so many people have not heard of it, or have no experience in it. Microsoft are changing who gets access to this data, and are currently rolling out Digest emails to E3, E1 and Business customers.

If you have the feature already turned on, then your users can probably already access their dashboard at https://myanalytics.microsoft.com/ and start checking it out.

MyAnalytics is controlled by a license under the Microsoft 365 product. Many people probably have all the components on, and therefore although users have had access to this product, it hasn’t really been visible. The Welcome email comes first, and it seems to be rolling out right now to Targeted Release users in Microsoft 365.

Beyond just turning MyAnalytics on, there’s a few admin controls available at the tenant level and user level. You’ll need to consider items like ‘should users be opted-in by default, or opted-out’ if there are concerns around data scraping – even though this all lives in your Microsoft tenant, there could still be staff that are not comfortable with this.

Nascar use MyAnalytics if that helps you point to another company using it:

As you can see, I’ve linked to a bunch of Microsoft documentation around this rather than rewriting what they have – always nice to see quality doco!

It’s worth checking out MyAnalytics now and deciding if it’s something you want – at least check the state of your settings before users start getting Welcome emails!

Update 20th September

The product group have advised me on one extra tip – disabling the ‘Weekly insights email‘ option at the admin end will actually disable the Welcome email too – documentation to be updated shortly.

Four Generations of the Lenovo ThinkPad X1 Yoga

Posted on September 3, 2019July 14, 2021 by Adam Fowler

Lenovo’s X1 Yoga is my favorite business laptop. Ever since the X1 Yoga Gen 1 came out, I liked it over the other X1 options as it was an all-rounder, while doing everything really well.

That first generation came out in 2016, and each year there’s been a new one, the 2nd Gen, 3rd Gen and now in 2019, we’re at the 4th Gen.

It’s about time I did a round up and comparison of these four models.

Lenovo ThinkPad X1 Yoga Gen 1

The Gen 1 came out in 2016 as the X1 Carbon became lighter, thinner and lost it’s touchscreen. There was mixed reaction to this decision from Lenovo, and although the Yoga had existed in several forms previously, this was the first in the ThinkPad X1 series.

Notable on this model is the OneLink+ connector – a shortlived port for a OneLink+ dock that only survived a single generation, to be replaced by USB-C/Thunderbolt. It has the standard rectangle style power plug hole, again this would not be seen on future X1 Yogas.

This is the only model to not have a dedicated Ethernet port, instead a special OneLink+ Ethernet dongle, USB2 100mbit dongle or USB3 gigabit dongle was required.

Lenovo ThinkPad X1 Yoga Gen 2

2017 saw this release with the 7th Gen Intel CPU and the OneLink+ port abandoned, replaced by USB-C. This was great, since it was now an industry standard and meant there was a lot of flexibility with what power pack and dock you could use.

This is the first model to have an OLED display option, and strangely this Gen 2 is slightly thicker and heavier than the Gen 1. There wasn’t that many improvements in this model, but overall it’s pretty well rounded solution.

Battery life on this was claimed to be a lot better than the Gen 1.

Lenovo ThinkPad X1 Yoga Gen 3

It was the third model’s turn in 2018 which saw few changes again. Another generation jump on the Intel CPU, which this time doubled the core count from the 7th to 8th mobile CPU generation.

Other smaller changes included the introduction of a shutter over the camera, a HDR display option with Dolby Vision, and the black colouring a bit different – the chassis is glossier, and anything silver has gone black including the hinges and ThinkPad logo (it still looks silver in this photo sorry!)

Lenovo ThinkPad X1 Yoga Gen 4

And finally, here we are in 2019 with the Gen 4 being released… and it’s a major jump. The biggest jump we’ve seen year to year so far. An all metal chassis, the laptop footprint has been drastically reduced (17% smaller footprint, 11% thinner), the colour is now ‘iron grey’ which I’m personally a fan of, and the screen to bezel distance is much smaller.

There’s also a new connector for a different ethernet dongle, and support for a new style of dock that connects on the left hand side to the combo USB-C/ethernet slot. Of course it’s jumped a CPU generation again, up to Intel’s 8th.

The MicroSD slot has been dropped, probably as part of making the laptop smaller. If you really need that, then look at any of the previous generations.

One other interesting feature is a new privacy screen option called PrivacyGuard that can be toggled on and off, and stops people seeing the screen on an angle. The retractable key feature has gone again – there’s no rubber feet to protect the keys, but they might be minutely sunk in, I couldn’t tell with the naked eye.

The final note on this model is that it has a very similar CPU to the Gen 3, still an 8th Generation Intel CPU but a newer variant – Whiskey Lake rather than Kaby Lake.

Let’s have a look at the 4 generations stacked together, going bottom to top Gen 1, Gen 2, Gen 3 and Gen 4:

You can see that footprint difference in the photos above. The 4th Gen looks completely different to the rest.

Each of my individual reviews lists out the possible specs for each model if you want to dive a bit further into the technical differences;

Lenovo Thinkpad X1 Yoga Gen 1
Lenovo Thinkpad X1 Yoga Gen 2
Lenovo Thinkpad X1 Yoga Gen 3
Lenovo Thinkpad X1 Yoga Gen 4

The X1 Yoga will never be as small and light as the X1 Carbon, and never be as portable as the X1 Tablet, nor the powerhouse of the X1 Extreme – but it is all of these devices at once in it’s own way. It’s still my pick of the X1 series for it’s flexibility, but the other choices could also be better for your personal needs if you know how you’re going to use it.

Share this:

Share this:

Share this:

Share this:

Share this: