Today I noticed for the first time, that the MyAnalytics emails that were coming through weekly, showing where your time was being spent, emails you may need to respond to etc had been replaced by Microsoft Viva. There’s also a post in TechCommunity covering this in detail.
The previous MyAnalytics emails would come in weekly, and be broken up into different editions – Wellbeing, Focus, Collaboration or Network edition. This new monthly digest indicates Microsoft Viva is the way forward. Note that this still works the same way as MyAnalytics where the contents of the email are private to you, and do not come as a normal email that would be trackable (more details in my MyAnalytics article)
That ‘Learn more’ link takes you here: https://www.microsoft.com/en-au/microsoft-viva/insights/?s=mya with some details around Microsoft Viva. One of the main links there takes you to Viva Insights on Teams, which is the Insights addin option that’ll show up on the left menu and take you to the Viva Insights Home page.
The Stay Connected tab is worth checking out, as it will highlight email conversations it thinks are things you need to do, or highlight people (team members for me) that you don’t have a 1 on 1 meeting scheduled for the next twk weeks.
Going back to the web page for Microsoft Viva, there’s a lot more content then when I looked when it first launched. One section I thought was notable was under Network, you can see your Top Collaborators and their read percent and response time of emails.
My point on all this, is that there’s a lot going on here. People may find it and have questions around it, especially when these emails are generated to all staff by default. Someone may have stumbled across the ‘Delay Delivery enabled’ option and turned it on, then forgotten about it later, complaining about emails being slow to get to customers or clients:
What we’re seeing above with Microsoft Viva and MyAnalytics (now Viva Insights) is only a part of the full Microsoft Viva solution too – there’s also Viva Connections, Viva Topics and Viva Learning:
Viva Connections and Viva Insights are generally covered under an existing license, but Viva Topics and Viva Learning are at an extra cost.
Microsoft announced that safe links are now Generally Available in Microsoft Teams. This is the same idea of Safe Links for email, and if you already have that on, enabling it for Teams is easy.
I won’t rehash all the details Microsoft have above, but Safe Links give a time of click assessment of a URL to check if they deem it safe. This can be better than time of delivery of the URL, as new threats emerge or the end results of the URL change.
From here, you probably just have one policy but could have more – edit the policy to affect the users you want, and in the “Protection settings” area, there will be an “Edit protection settings” link
Once editing, just set the radio button to ‘on’ against ‘Select the action for unknown or potentially malicious URLs within Microsoft Teams. Microsoft haven’t updated the warning around being in preview despite the GA announcement.
Once done, and waiting for a timeframe I’m not sure on, Teams will start using Safe Links. URLs being used in Teams look the same as before, and even if you hover over them, they show the actual end result link:
But when clicked, you’ll see this jump page while Microsoft Defender for Office 365 verifies the link:
Regardless of the link being clicked, the URL for me always displayed this:
It verified the link very quickly in my testing, less than a second each time. At this stage I can’t see any way to configure this page, or disable the option to Skip verification to enforce security, but we’ll see what happens.
I thought I should write up a little bit of information on a site I created; msportals.io and how it’s doing:
Being a Microsoft 365 Administrator at the time, I was looking for a list of all the Microsoft portals, particularly from an administrator point of view. A lot of lists were floating around, but nothing that was being maintained or comprehensive enough. I’d asked around a lot around it, others had the idea that they were going to create something – but nothing happened. It was a pretty simple idea and I was hardly the first to have it…
I also had the idea of creating this list on GitHub. I’d already been looking at GitHub Pages to move my blog to, but not being a programmer or developer, I was finding it too difficult to try and work out how to migrate and have feature parity with what I was using on WordPress. However, the GitHub Pages free tier, allowing 500mb of data in a public Github Repository sounded like a perfect fit for me, providing a platform for a list of URLs.
I started to collect and write up a list of portals. Just the name of the portal, and a link to it. I wasn’t using any GitHub client or command line things, purely using the web based interface for GitHub to start putting data in and seeing how it looked on the resulting msportals.github.io site. It seemed fine, so I started asking around for people to tell me of any links I might be missing. People jumped on board pretty quickly to help (read my thanks section here) to provide portals, but also to actually contribute to the project and provide features that would have taken me a very long time to work out myself.
I also bought a domain – msportals.xyz as it only cost a few dollars a year, and GitHub Pages supports bringing in your own domain. I had the site up, started using it.. and though I should throw it out there to see how much criticism it brought. I posted a tweet:
I didn’t expect to get much of a response – it was more of a test so I could properly launch later. Instead, as I expect what often happens on projects like this, it blew up. It turned out to be my most popular tweet of all time, with almost 100k views. My only annoyance of this was that I had no statistics to collect on how much the site was being used! Quickly I had help to add in Google Analytics to the site, so about a week later I had stats.
Since mid November 2020, the site has had 55,000 users hit it. As expected, the engagement time is tiny – you go to the site and click a link.
That peak is when The Register wrote an article on the site. The site changed from msportals.xyz to msportals.io after @SwiftOnSecurity bought it and handed it over, after some discussion around certain firewalls blocking xyz domains under some standard settings:
Updates and suggestions to the the portal of Microsoft portals came think and fast for a while – nice features like a filter so you can just type ‘teams’ and see the link to the Teams portal were implemented by others (mdjx), due to the way open source platforms like GitHub work.
I don’t see as many portal suggestions and updates these days, but they still trickle in. I still use the site frequently, and see people pop up time to time saying how much they like it which is awesome to hear; I really wanted something functional for myself, and if others also liked it, that was a bonus.
I actually had an idea for another site – a list of PowerShell modules with the commands to both install and connect to different things like Exchange Online and Microsoft Teams. Someone had beaten me to it (which is good!), and had done it a similar way; check out https://msshells.net/ by Andrés Gorzelany to have a look at what he’s done.
If you’ve got your own idea for something like this, go for it! You can do it entirely for free if you don’t care about your own top level domain, and it’s an interesting project to try.
I thought I’d document a few lessons learned in this migration. The migration was from Skype for Business Server 2015 and Skype for Business 2016 clients with Enterprise Voice, moving users across to Microsoft Teams.
The steps to migrate a user for me were:
Add user to AD Group “Azure AD Licensing Telstra Calling for Office 365” as this allocates a Telstra Calling for Office 365 license. These licenses are bought from https://marketplace.telstra.com/ and feed into Microsoft 365. I believe this is unique to Australia.
From Skype for Business Server Management Shell: $cred=Get-Credential $url="https://adminau1.online.lync.com/HostedMigration/hostedmigrationService.svc" (different links here for different countries) Move-CsUser -Identity email@example.com –Target sipfed.online.lync.com -MoveToTeams -Credential $cred -HostedMigrationOverrideUrl $url set-csuser -identity firstname.lastname@example.org -LineURI $null
Form a machine with the Teams PowerShell Module installed: $Session = New-CSOnlineSession -OverrideAdminDomain yourdomain.onmicrosoft.com Import-PSSession $session –AllowClobber Set-CsOnlineVoiceUser -Identity email@example.com -TelephoneNumber 61812341234 Grant-CsTeamsUpgradePolicy -PolicyName UpgradeToTeams -Identity firstname.lastname@example.org
Configure call forwarding in Gateway (Pilot Users only that were being given a new number out of our normal number range)
EHR Error on Teams Portal
Seeing this error everywhere on the Teams Admin portal, unsure what the cause/fix is yet. It ended up disappearing by itself after a few weeks *shrug* – you’ll see this theme is common around portal errors.
Dial Plans error
Going into any Dial Plan brings up this admin portal error, as well as trying to run a Test Dial plan test:
This problem was another portal issue – logged a case which Microsoft confirmed was at their end, and a few weeks later they’d resolved it.
Create Resource Account error
When creating a Resource Account used for Auto Attendant or Call queues, I was getting a very unhelpful error. I believe this is because I’m running in hybrid mode, so Teams can’t create an account on my primary domain – changing the domain to @contoso.onmicrosoft.com then let me create the Resource Account.
This problem also disappeared later and now I can create accounts on my primary domain – put it down to another portal issue.
DeskPhones requiring PIN
Phones would be registered in Intune, because they’re running Android – and that means any ‘all user’ Android policy would apply.
I’ve since created Dynamic Device Groups and filtered by DeviceModel and DeviceOSType – only testing the Poly CCX500 at this stage, but will add more models as we get them. Also filtering by OStype which is not really necessary, but does make sure it’s only Android devices affected.
(device.deviceModel -eq "CCX500") and (device.deviceOSType -eq "Android")
If you use a test account 20 times, that account will hit its device limit in azure and get locked out.
Skype for Business users unable to call Teams users
Early in migration, we tested interoperability between the two platforms, as it wasn’t going to be an overnight company wide migration. A Skype for Business user trying to call a migrated to Teams user would instead get diverted elsewhere. This was because we had Unassigned Number range rules in place, that were designed to send calls somewhere if it wasn’t allocated to anyone. Removing these rules immediately fixed this issue.
Home Screen on Desk Phones Laggy
The default experience if the phone supports it, is to show a home screen. More details on what the Home Screen is here. This is in CsTeamsIPPhonePolicy with the default value ‘AllowHomeScreen’ set to ‘EnabledUserOverride’. Changing this to Disabled via the PowerShell command:
removed this. I like the idea of the Home Screen, but not at the cost of a fast functioning phone vs a slow one.
I later found out this is due to the 1GB RAM on some devices, and Teams now (at the time of writing) uses > 1GB RAM, and then the Home Screen uses even more RAM. Trying a phone model with 2GB RAM this all worked perfectly.
I believe this is also fixed now, but it took Microsoft about 5 months to resolve.
New Desk Phones not signing in
Testing the Poly CCX500 model, some wouldn’t sign in to Teams out of the box. As soon as I tried to sign in, they’d say:
‘Error Could not sign in. You will need to sign in again. If you see this message again, please contact your company support. OK’
I spent so long on this, unsuccessfully trying to update the firmware via USB etc. In the end, turning off the ‘DHCP Time’ setting under ‘Device Settings’ made it work – I assume it had some problems contacting a NTP server (settings appeared correct in the DHCP scope of the phone). Someone else found the same issue here, but this was due to the phone running a very old v1 firmware. This shouldn’t affect most people, but worth noting.
When there was a name change in Active Directory (AD), we used to update the Universal Principal Name (UPN) in AD, then separately run the Set-MsolUserPrincipalName command to update Azure AD to the same UPN. Except, it no longer worked – I was now getting an ‘Access Denied’ message.
When trying to update the UPN via the Microsoft 365 admin center, it would correctly advise that the object was homed in AD, so changes needed to be made there. Except, they were, and Azure AD Connect was even reporting that it had seen the update and sent it off to Azure AD, no errors.
In my testing, running another Azure AD Sync (both delta and full) did not resolve any already updated UPNs. I had to change the UPNs to a temporary value, sync, then change them back to the original value I wanted, and sync again. The update was instant in Azure AD once the sync had run each time.