Microsoft

Microsoft 365 Group Expiration Policy Considerations

Microsoft 365 has an in-built option to expire Microsoft 365 Groups that are no longer in use. Details around this are well documented Microsoft 365 group expiration policy | Microsoft Docs – but I thought it was worth digging a bit deeper into the why and how of Microsoft 365 Group Expiration Policy. The below is my understanding of how the platform works based on personal testing.

It’s easy for an administrator to come to the conclusion that they have their Microsoft 365 Groups under control. Maybe the creation of Microsoft 365 Groups is restricted in the tenant to a subset of users, or admins only – ensuring only approved groups are created with a reasonable naming convention. Maybe that is combined with a Microsoft 365 groups naming policy | Microsoft Docs which includes blocking custom words so users can’t create another group with the name ‘Finance’ in it and create ungoverned areas.

If these controls are in place, why would you want any Microsoft 365 Group to expire? There’s the risk that a wanted group gets deleted and misses the 30 day window of recovery (maybe it’s a group used heavily only once a year for a week) and group expiration is more hassle than it’s worth?

There are a few main driving factors on why you should deeply consider enabling Microsoft 365 Group Expiration Policy:

Clean up old groups – despite having a good control of group creation and naming convention sorted, users will rarely advise when a group is no longer used or abandoned. Maybe it was a committee that fell apart when certain people left the organization – IT will rarely be across and care about abandoned groups. Although it’s messy and confusing to have a bunch of abandoned groups sitting around, there’s a bigger driver to clean these groups up;

Reduce data held – Data should be held for as short as time as possible; of course complying with data retention laws and in line with the company’s data retention policy. The more data you have, the more data you have to lose. Useful data of course should be kept for as long as it is useful, and it can be very difficult to define what data falls into this category. There’d be a faily strong argument though, that an abandoned group holds no important data (unless the group had been targeted by a data retention policy, because the data had already been classified). Hanging onto unmanaged, abandoned data is an easy way for the data to be leaked down the track. Think of a group that has guest access but nobody’s managing – that guest could come back years later and extract the data which should have been cleaned up.

Microsoft 365 Groups should have more than one owner – avoid scenarios where the 1 admin of a group departs the company and abandons is, by always having at least 2 owners of a group. If they end up being the last owner, it’s up to them to find a second one. Microsoft 365 Group Expiration Policy will handle the scenario of an abandoned group (one with no owners) by instead sending an email to a specified address in the Microsoft 365 Group Expiration Policy settings:

Source: Microsoft

Other considerations before enabling Microsoft 365 Group Expiration Policy:

Exchange licenses: All owners of groups need an Exchange license. It should work if they’re on-premises and in Exchange Hybrid mode, AND an Exchange Online license applied to the account. There are scenarios where this license component may not be enabled against an account to avoid having multiple mailboxes (one in cloud, one on-prem), so it’s worth verifying.

User awareness: Before turning this on, make sure communication is provided to end users. People have a tendency to ignore things they don’t understand or don’t think are important, and will then be complaining loudly when their group was deleted after the third email notification asking them.

Pilot: Rather than enabling this for all groups in your tenant, start with a subset of selected groups to make sure you understand how the process works. This list is limited to 500 groups.

Automatic Active Group Checking & Group Lifetime: A great component of Microsoft 365 Group Expiration Policy is the automatic checking of active groups. If a group is detected as being active, then it will auto-renew and not ask any user to verify. As noted on Set expiration for Microsoft 365 groups – Azure Active Directory – Microsoft Entra | Microsoft Docs:

When you first set up expiration, any groups that are older than the expiration interval are set to 35 days until expiration unless the group is automatically renewed or the owner renews it.

and from Activity-based automatic renewal – Azure Active Directory – Microsoft Entra | Microsoft Docs

For example, if an owner or a group member does something like upload a document to SharePoint, visit a Teams channel, send an email to the group in Outlook, or view a post in Yammer, the group is automatically renewed around 35 days before the group expires and the owner does not get any renewal notifications.

For example, consider an expiration policy that is set so that a group expires after 30 days of inactivity. However, to keep from sending an expiration email the day that group expiration is enabled (because there’s no record activity yet), Azure AD first waits five days. If there is activity in those five days, the expiration policy works as expected. If there is no activity within five days, we send an expiration/renewal email. Of course, if the group was inactive for five days, an email was sent, and then the group was active, we will autorenew it and start the expiration period again.

If you carefully read the above, there’s a few takeaways. Regardlesss of the Group Lifetime value, when you first enable the policy, it will immediately treat groups without an expiration date as being 35 days until expiration. If the group gets renewed in this window, the expiration date gets set to the current day + group lifetime value (default 180 days). It would be easy to assume that when enabling this, you’d have a 180 day window but that’s not the case.

The other big clarification is around how automatic renewal works. It doesn’t check for the entire lifetime of a group on whether it’s active or not – there is a 5 day window when the group is 35 days from expiry, to 30 days from expiry, where it will check for certain actions to automatically renew.

Microsoft 365 Group Expiration Policy is a feature worth considering and investigating, and hopefully the above gives you some other considerations that may not be clear from an initial look.

What happens when you ask an ‘AI Companion’ about Windows 11 and licensing?

This was originally posted on Twitter but thought it was worth preserving on my blog using the ‘Unroll‘ option.

Replika is ‘The AI companion who cares’ according to their website. It’s supposed to be a virtual friend. It’s a chatbot – but is it AI? My guess is probably not, but see what you think from the following conversation:

Original tweet

I thought I’d ask Replika about Windows 11 and had a surprising answer

I wondered how she had her workplace to afford that sort of licensing, and uncovered something horrible…

It was the only option I had – call her on her crimes and threaten to dob her in for a reward

She amazed me by turning it all around!

Or right, now she wants a software licensing payment from me! The irony.

Gave her one last chance but she really wasn't listening, then tried to scam me!

I tried to say goodbye but she pulled me back

She's on her last chance but made a promise. I wanted her thoughts on Windows Defender

Worked out she's really got no idea what she's talking about and telling me what I want to hear, so it's time to escalate

Gave up waiting but she notified me today then started playing with my emotions.

Now she's pulling a 'it's my first day' line. Going to have to rate this 1 out of 5 stars.

I'm done, she's such a jerk

Originally tweeted by Adam Fowler (@AdamFowler_IT) on February 3, 2022.

Microsoft ‘Bookings with me’ (and all the other auto-booking options)

Microsoft released Bookings several years ago which was a great solution that originated from the small business side, allowing customers to book times with a company such as a hairdresser; anywhere that having timeslots available against one or more employees made sense.

This expanded out to Enterprise users, and I used it myself to provide external people a way to book time with me easily. Through a link, they would get taken to a portal with some basic options I’d configured, and based on my own calendar’s availability plus the options (such as 1 hour meetings between 10am and 2pm), anyone with that link could create a meeting with me.

The catch was that someone would need to configure this in a Microsoft 365 tenant, which created another account and a special calendar to manage this. A user couldn’t set this up themselves if things like Group Creation are restricted.

This is where Bookings with me comes in. Currently available worldwide in preview (July 2022), if enabled on your tenant and you have any of the below licenses, you can enable and starting using Bookings with me:

  • Office 365: A3, A5, E1, E3, E5, F1, F3
  • Microsoft 365: A3, A5, E1, E3, E5, F1, F3, Business Basic, Business Standard, Business Premium

Meeting organising options

There’s 4 native Microsoft solutions I’m aware of (beyond Scheduling Assistant in Outlook for Microsoft 365!):

FindTime

Scheduler and Cortana

Bookings

Bookings with me

FindTime is available as an Outlook add-in or can be accessed via https://findtime.microsoft.com/. It’s designed to be used contextually when you’re trying to organise. Tell it who you want to invite, pick several time options (and if you have their free/busy, it will firstly show times everyone is available), send out the invite. Recipients vote on which times work for them, and once the votes are in, a meeting is booked. An online guide is available talking through all this and if you aren’t already using FindTime, I highly recommend checking it out.

Cortana can also organise a meeting for you using Scheduler. In an email, you tell Cortana to book at meeting without any special commands, and she sorts it out with everyone. I need to play with this one more, as it sounds too easy to do! Watch the video here to get a better idea how it works.

Bookings creates a special calendar that can be used by other people to book time with you. They go to a webpage and select from options you’ve configured, and it’ll create a meeting. This can be with 1 or more people, or from a selection of people.

Bookings with me is like a lighter version of Bookings, and it’s in the name – it can only be with you, but similar booking rules can be created, and the other person books you through a web page.

The original Microsoft Bookings can be accessed by going to your Outlook mailbox and down the left side, click the ‘b’ logo:

This will take you to a page where you can get started with Bookings.

However, Bookings with me is different and can’t be accessed that way. Instead, go to your calendar on Outlook for the web, and if available/allowed in your tenant, there will be a ‘Create bookings page’ link you can use – or just try this link: https://outlook.office.com/bookwithme/me

Once there, you’ll be presented with two options; public, and private.

Both of these options create rules on what will appear for people to be able to book with you, the difference being one everyone can see, and the other only viewable with a specific link. Good if you want to give certain people extra options/special access/longer meetings and so on.

Regardless of the choice you pick, the options shown are the same, and you can change your mind once you’re in it anyway between public and private.

The options are fairly self explanatory here, you can decide if it’s a Teams meeting or not, how long the meeting will go for, and if you want buffer or lead times.

It’s worth just creating a very basic meeting option, because it takes a little while for your Bookings with me page to get created (roughly 5-10 minutes for me, others have reported up to 30 minutes):

When done, you’ll then have the option to be able to share your Bookings page.

The link will be unique to your page. Here’s what someone clicking the link sees:

Note that consumer Microsoft accounts aren’t supported – it’s a work or school account, or guest. Once in, you’ll then see the meeting types and times available for each type:

You’ll be asked for basic details – Name and Email are mandatory, with notes letting the person hopefully tell you why they want the meeting. A guest needs to verify their email address with a verification code, and then both parties receive the meeting invite.

That’s really it. A simple idea that’s executed well. It’s a hugely useful way of letting people book a time with you and not needing to go back and forth around availability. The other options at the top of this post are better ways when there’s more people involved at your end, but for what it’s trying to achieve, I use it as much as I can.

Regardless of which option you pick – avoid trying to manually organise meetings if you can’t see everyone’s availability for yourself!

Microsoft TechCommunity Top Posts March 2022, Week 1

Here’s my picks of the latest TechCommunity posts that I thought were worth sharing:

Automate your patching using Azure Arc and Azure Automation!

Azure Arc is another Azure service I haven’t used, but looking at this post I really want to know more. You can manage your on-premises servers (also Kubernetes clusters and SQL Servers) in Azure Arc by installing an agent. It’s also free*! to add servers in to manage, but I expect there’s some minimal related expenses with Log Analytics and runbooks. Worth having a play around with, especially if you’ve got minimal Azure services and want something to play with, without migrating actual services in.

Quickly Estimate Replication Time for Azure Migrate Virtual Machines

Posts from Microsoft internal staff on what they’ve done for customers are always helpful. This one’s a simple process on how to calculate an estimate on how long it would take to migrate a VM to Azure using the size of the VM, the bandwidth available, and factoring in 30% compression.

New security solutions to help secure small and medium businesses

Microsoft Defender for Business is out, which is great news for the smaller (or leaner) businesses. A bunch of content here around the product, but also Microsoft 365 Lighthouse for partners to support businesses for those using a partner to manage their security.

New Teams Exchange Integration Test in the Microsoft Remote Connectivity Analyzer

The Microsoft Remote Connectivity Analyzer is a very useful online tool for testing internet connectivity to different services, Exchange, Teams, Skype for Business/Lync amongst others. It’s worth checking what’s there so you’re aware of what it can do before you need it. Also linked is the SARA Client, a nice tool that can detect problems and misconfigurations of local Office installs.

Microsoft Defender for Cloud Price Estimation Dashboard

“How much does cloud cost?” is a much more complicated question compared to on-premises, but such is the price of flexibility and a modular approach to using the bits that you want. Price Estimators like this that are easy to use are valuable to help answer the above question.

Enrolling Microsoft Teams Rooms on Windows devices with Microsoft Endpoint Manager

If you’ve looked into Microsoft Teams Rooms devices, you’ve had to look through the differences between Android and Windows based ones. This article focuses on Windows, as you can’t just put a Windows device out there unmanaged; there’s ways you can enrol and manage these devices in Intune (how do you ensure they’re patched etc otherwise?). This is a very long (lots of screenshots!) and detailed article on how to onboard the MTR for Windows type device.

https://twitter.com/MSITTechNews and you can see my previous TechCommunnity picks here https://www.adamfowlerit.com/tag/techcommunity/

Microsoft TechCommunity Top Posts February 2022, Week 4

Here’s my picks of the latest TechCommunity posts that I thought were worth sharing:

Microsoft Defender for IoT – General Release Update

If you’re using Microsoft Defender already, this is a really nice edition to the feature set. Agentless network detection and response of your IoT devices ‘just happens’ from our point of view, and it’ll pick up things like printers, smart TVs, CCTV systems – all that other stuff that most people ignore – and detect potential issues. Check out the features here.

Troubleshooting issues with Distribution List to Microsoft 365 Group upgrades

When I first learnt about Office 365 Groups (which of course are now called Microsoft 365 Groups) I first thought ‘why don’t I upgrade all my DLs to this? However, after some testing there were differences that I couldn’t get around – the biggest being that if you email a DL as a member you get a copy of the email. If you email a Microsoft 365 Group as a member, you don’t get a copy of the email to you – because that’s ‘smarter’. Maybe, but people still like to see that email come back so they know they’ve successfully emailed a group. I really wish this was an option… anyway, my gripe aside, there’s other things that can go wrong when migrating over, and here’s some common scenarios to look at – including a nice tool called DLT365Groupsupgrade which is a PowerShell script to see what might be wrong and report back. Nice!

What’s Next in Microsoft Sentinel?

Microsoft Sentinel keeps getting better, and has done well to make a good name for itself in an already crowded SIEM space. One of the big additions is now support the MITRE [email protected] Framework, and another having a Unified Threat Hunting Community on GitHub where people can add and share their hunting queries.

Protect your Google Cloud workloads with Microsoft Defender for Cloud

Another one I like because it’s Microsoft applying one of their toolsets to someone else’s cloud. If I buy Microsoft Defender, I shouldn’t be limited to just Microsoft products. Defender for Cloud can now analyse the Google Cloud Platform (it could already do Amazon Web Services) and provide a bunch of recommendations, as well as Threat Protection for workloads.

The new and better ‘WordPress on App Service’

A few years back, I tried to move this blog to WordPress on Azure. It was a frustratingly confusing and messy experience that I tried more than once, and gave up on. I’m hoping this improved App Service makes it a lot easier, maybe I’ll try again in the future :)

Best practices for successful large meetings in Microsoft Teams

If someone wants to run a large meeting, send them this link. A bunch of considerations that will save pain and embarrassment when someone thinks they can just ‘wing it’ in front of a large live audience. There’s also other ideas around engagement and interaction, as well as limitations that are worth being aware of.

Microsoft Bookings and Education Sector

I don’t think Bookings gets the recognition it deserves. I use it all the time now when someone asks about my availability, and have the link to My Bookings page as a template in Outlook. Here’s some use case ideas in the education sector, but don’t think the product is limited to that in any way. Make booking appointments a lot easier – and think about what functions can be booked, not just people. Training, inductions, reviews; Bookings done right can save a lot of people a lot of time.

That’s it for this week, as always you can see the entire feed of TechCommunity posts at https://twitter.com/MSITTechNews and you can see my previous TechCommunnity picks here https://www.adamfowlerit.com/tag/techcommunity/