Azure – Page 27 – Set-AzWebApp -name "Anything Microsoft and other stuff on the side"

Top 10 actions to secure your environment

Posted by Harri Jaakkonen Posted on 10/04/2019 0 Comments

Posted in Azure, Security

Hi, Microsoft has a blog series about securing our environment. The first one came in December 2018. For now there is 8 parts released, hopefully part 9 is coming soon. When almost all functions are out in the open these…

Office 365 Group and alias email-address.

Posted by Harri Jaakkonen Posted on 23/11/2017 0 Comments

Posted in Azure, Exchange, Office 365, Powershell

If You want to archive this You have to use Powershell. Connect to Exchange Online Powershell and use the command below:

Set-UnifiedGroup -Identity GroupMailboxIdentity@domain.fi -EmailAddresses @{Add='alias@domain.fi'}

1	Set-UnifiedGroup -Identity GroupMailboxIdentity@domain.fi -EmailAddresses @{Add='alias@domain.fi'}

Happy Powershelling,

Getting started with Windows Autopilot

Posted by Mikko Pantti Posted on 26/10/2017 0 Comments

Posted in Azure, Intune, Windows 10

Here is a small guide, on how to get started with Windows Autopilot. First thing that you need to make sure, is that you have the following prerequisites: Devices must be registered to the organization Devices have to be pre-installed…

Get a Msolusers with License details to seperate CSV-files.

Posted by Harri Jaakkonen Posted on 06/04/2017 0 Comments

Posted in Azure, Office 365, Powershell

Hi again, Today I found a script export users and licenses to csv-file. This one worked out nicely 🙂 http://sikkepitje.blogspot.fi/2016/10/get-msoluserlicense.html

<#

    Get-MsolUserLicense.ps1
    
    makes a report of license type and service plans per use , and saves one Excel-sheet (CSV) per uses license type.

    Original source: https://gallery.technet.microsoft.com/scriptcenter/Export-a-Licence-b200ca2a?tduid=(26fc5a009171934296bd78c7f4dd6590)(256380)(2459594)(TnL5HPStwNw-0Z3.3otQ5VeALpBrI1CXBg)()

    created by Alan Byrne
    modified 20161006 by p.wiegmans@bonhoeffer.nl/sikkepitje@hotmail.com

    Changed separator from comma to semi-comma, fixes formatting errors whene displayname contains comma (very common).
    Changed: separate output file , one for each license type.
    Changed: added timestamp to filename. 
    Changed: Fetching all users once, instead of every license type, givea huge speed boost.
#>

$VerbosePreference = 'Continue'    # Makes verbose meldingen zichtbaar : Modify to your needs
# The Reports will be written to files in the current working directory

# Connect to Microsoft Online IF NEEDED
#write-host "Connecting to Office 365..."
#Import-Module MSOnline
#Connect-MsolService -Credential $Office365credentials

# Get a list of all licences that exist within the tenant
$licensetype = Get-MsolAccountSku | Where {$_.ConsumedUnits -ge 1}

Write-Verbose "License types are:" 
$lts = $licensetype| select -expandproperty accountskuid | Format-Table -Autosize | Out-String
Write-Verbose $lts

Write-Verbose "Getting all users (may take a while) ..."
$allusers = Get-MsolUser -all 
Write-Verbose ("There are " + $allusers.count + " users in total")

# Loop through all licence types found in the tenant
foreach ($license in $licensetype) 
{ 
 # Build and write the Header for the CSV file
    $LicenseTypeReport = "Office365_" + ($license.accountskuid -replace ":","_") + "_" + (Get-Date -Format "yyyyMMdd-HHmmss") + ".csv"
    Write-Verbose ("New file: "+ $LicenseTypeReport)

 $headerstring = "DisplayName;UserPrincipalName;JobTitle;Office;AccountSku"
 
 foreach ($row in $($license.ServiceStatus)) 
 {
  $headerstring = ($headerstring + ";" + $row.ServicePlan.servicename)
 }
 
 Out-File -FilePath $LicenseTypeReport -InputObject $headerstring -Encoding UTF8 -append
 
 write-Verbose ("Gathering users with the following subscription: " + $license.accountskuid)

 # Gather users for this particular AccountSku
 $users = $allusers | where {$_.isLicensed -eq "True" -and $_.licenses.accountskuid -contains $license.accountskuid}

 # Loop through all users and write them to the CSV file
 foreach ($user in $users) {
  
        $thislicense = $user.licenses | Where-Object {$_.accountskuid -eq $license.accountskuid}
        $datastring = (($user.displayname -replace ","," ") + ";" + $user.userprincipalname + ";" + $user.Title + ";" + $user.Office + ";" + $license.SkuPartNumber)
  
  foreach ($row in $($thislicense.servicestatus)) {   
   # Build data string
   $datastring = ($datastring + ";" + $($row.provisioningstatus))
  }  
  Out-File -FilePath $LicenseTypeReport -InputObject $datastring -Encoding UTF8 -append
 }
} 

write-Verbose ("Script Completed.")

Get-MsolUserLicense.ps1

makes a report of license type and service plans per use , and saves one Excel-sheet (CSV) per uses license type.

Original source: https://gallery.technet.microsoft.com/scriptcenter/Export-a-Licence-b200ca2a?tduid=(26fc5a009171934296bd78c7f4dd6590)(256380)(2459594)(TnL5HPStwNw-0Z3.3otQ5VeALpBrI1CXBg)()

created by Alan Byrne

modified 20161006 by p.wiegmans@bonhoeffer.nl/sikkepitje@hotmail.com

Changed separator from comma to semi-comma, fixes formatting errors whene displayname contains comma (very common).

Changed: separate output file , one for each license type.

Changed: added timestamp to filename.

Changed: Fetching all users once, instead of every license type, givea huge speed boost.

$VerbosePreference = 'Continue' # Makes verbose meldingen zichtbaar : Modify to your needs

# The Reports will be written to files in the current working directory

# Connect to Microsoft Online IF NEEDED

#write-host "Connecting to Office 365..."

#Import-Module MSOnline

#Connect-MsolService -Credential $Office365credentials

# Get a list of all licences that exist within the tenant

$licensetype = Get-MsolAccountSku | Where {$_.ConsumedUnits -ge 1}

Write-Verbose "License types are:"

$lts = $licensetype| select -expandproperty accountskuid | Format-Table -Autosize | Out-String

Write-Verbose $lts

Write-Verbose "Getting all users (may take a while) ..."

$allusers = Get-MsolUser -all

Write-Verbose ("There are " + $allusers.count + " users in total")

# Loop through all licence types found in the tenant

foreach ($license in $licensetype)

{

# Build and write the Header for the CSV file

$LicenseTypeReport = "Office365_" + ($license.accountskuid -replace ":","_") + "_" + (Get-Date -Format "yyyyMMdd-HHmmss") + ".csv"

Write-Verbose ("New file: "+ $LicenseTypeReport)

$headerstring = "DisplayName;UserPrincipalName;JobTitle;Office;AccountSku"

foreach ($row in $($license.ServiceStatus))

{

$headerstring = ($headerstring + ";" + $row.ServicePlan.servicename)

}

Out-File -FilePath $LicenseTypeReport -InputObject $headerstring -Encoding UTF8 -append

write-Verbose ("Gathering users with the following subscription: " + $license.accountskuid)

# Gather users for this particular AccountSku

$users = $allusers | where {$_.isLicensed -eq "True" -and $_.licenses.accountskuid -contains $license.accountskuid}

# Loop through all users and write them to the CSV file

foreach ($user in $users) {

$thislicense = $user.licenses | Where-Object {$_.accountskuid -eq $license.accountskuid}

$datastring = (($user.displayname -replace ","," ") + ";" + $user.userprincipalname + ";" + $user.Title + ";" + $user.Office + ";" + $license.SkuPartNumber)

foreach ($row in $($thislicense.servicestatus)) {

# Build data string

$datastring = ($datastring + ";" + $($row.provisioningstatus))

}

Out-File -FilePath $LicenseTypeReport -InputObject $datastring -Encoding UTF8 -append

}

write-Verbose ("Script Completed.")

Script that assigns Office 365 licenses based on Group membership.

Posted by Harri Jaakkonen Posted on 06/04/2017 0 Comments

Posted in Active Directory, Azure, Office 365, Onpremise, Powershell

Hi, Again Johan the author at 365lab.net wrote a nice script. It will change user license based on AD Group Membership.

<#  
.SYNOPSIS 
    Script that assigns Office 365 licenses based on Group membership in WAAD.
.DESCRIPTION
    The script assigns of licenses for new users based on groups/licenseSKUs in the $licenses hashtable.
    It switch licensetype if a user is moved from one group to Another.
    It removes the license if the user no longer is a member in any of the license assignment Groups.
    Updated 2015-03-25 to support multiple skus for each user.
    The script REQUIRES PowerShell 3.0 or later!
.NOTES 
    Author: Johan Dahlbom 
    Blog: 365lab.net 
    Email: johan[at]dahlbom.eu 
    The script are provided “AS IS” with no guarantees, no warranties, and they confer no rights.     
#>
#Import Required PowerShell Modules
Import-Module MSOnline
    
#Office 365 Admin Credentials
$CloudUsername = 'admin@365lab.net'
$CloudPassword = ConvertTo-SecureString 'Password' -AsPlainText -Force
$CloudCred = New-Object System.Management.Automation.PSCredential $CloudUsername, $CloudPassword
    
#Connect to Office 365 
Connect-MsolService -Credential $CloudCred
    
$Licenses = @{
                 'E1' = @{ 
                          LicenseSKU = 'mstlabs:STANDARDPACK'
                          Group = 'E1_Users'
                        }                        
                
                 'E3' = @{ 
                          LicenseSKU = 'mstlabs:ENTERPRISEPACK'
                          Group = 'E3_Users'
                        }
            }
    
$UsageLocation = 'FI'
    
#Get all currently licensed users and put them in a custom object
$LicensedUserDetails = Get-MsolUser -All | Where-Object {$_.IsLicensed -eq 'True'} | ForEach-Object {
 [pscustomobject]@{
            UserPrincipalName = $_.UserPrincipalName
            License = $_.Licenses.AccountSkuId
            }
 }
    
#Create array for users to change or delete
$UsersToChangeOrDelete = @()
    
foreach ($license in $Licenses.Keys) {
      
  #Get current group name and ObjectID from Hashtable
  $GroupName = $Licenses[$license].Group
  $GroupID = (Get-MsolGroup -All | Where-Object {$_.DisplayName -eq $GroupName}).ObjectId
  $AccountSKU = Get-MsolAccountSku | Where-Object {$_.AccountSKUID -eq $Licenses[$license].LicenseSKU}
    
  Write-Output "Checking for unlicensed $license users in group $GroupName with ObjectGuid $GroupID..."
  #Get all members of the group in current scope
  $GroupMembers = (Get-MsolGroupMember -GroupObjectId $GroupID -All).EmailAddress
  #Get all already licensed users in current scope
  $ActiveUsers = ($LicensedUserDetails | Where-Object {$_.License -eq $licenses[$license].LicenseSKU}).UserPrincipalName 
  $UsersToHandle = ''
    
    if ($GroupMembers) {  
        if ($ActiveUsers) {  
            #Compare $Groupmembers and $Activeusers
            #Users which are in the group but not licensed, will be added
            #Users licensed, but not, will be evaluated for deletion or change of license 
            $UsersToHandle = Compare-Object -ReferenceObject $GroupMembers -DifferenceObject $ActiveUsers -ErrorAction SilentlyContinue -WarningAction SilentlyContinue
            $UsersToAdd = ($UsersToHandle | Where-Object {$_.SideIndicator -eq '<='}).InputObject
            $UsersToChangeOrDelete += ($UsersToHandle | Where-Object {$_.SideIndicator -eq '=>'}).InputObject  
        } else {  
            #No licenses currently assigned for the license in scope, assign licenses to all group members.
            $UsersToAdd = $GroupMembers
        }
    
    } else {  
      Write-Warning  "Group $GroupName is empty - will process removal or move of all users with license $($AccountSKU.AccountSkuId)"
      #If no users are a member in the group, add them for deletion or change of license.
      $UsersToChangeOrDelete += $ActiveUsers
    }
            
  #Check the amount of licenses left...
  if ($AccountSKU.ActiveUnits - $AccountSKU.consumedunits -lt $UsersToAdd.Count) { 
        Write-Warning 'Not enough licenses for all users, please remove user licenses or buy more licenses'
  }
           
     foreach ($User in $UsersToAdd){
    
        #Process all users for license assignment, if not already licensed with the SKU in order.  
          if ((Get-MsolUser -UserPrincipalName $User).Licenses.AccountSkuId -notcontains $AccountSku.AccountSkuId) {
            try {  
                  #Assign UsageLocation and License.
                  Set-MsolUser -UserPrincipalName $User -UsageLocation $UsageLocation -ErrorAction Stop -WarningAction Stop
                  Set-MsolUserLicense -UserPrincipalName $User -AddLicenses $AccountSKU.AccountSkuId -ErrorAction Stop -WarningAction Stop
                  Write-Output "SUCCESS: Licensed $User with $license"
            } catch {  
                  Write-Warning "Error when licensing $User"
    
            }
            
          }  
     }
}
    
#Process users for change or deletion
if ($UsersToChangeOrDelete -ne $null) {
        foreach ($User in $UsersToChangeOrDelete) {
          if ($user -ne $null) {
    
            #Fetch users old license for later usage
            $OldLicense = ($LicensedUserDetails | Where-Object {$_.UserPrincipalName -eq $User}).License
                 
             #Loop through to check if the user group assignment has been changed, and put the old and the new license in a custom object.
             #Only one license group per user is currently supported.
             $ChangeLicense = $Licenses.Keys | ForEach-Object {
                  $GroupName = $Licenses[$_].Group
                  if (Get-MsolGroupMember -All -GroupObjectId (Get-MsolGroup -All | Where-Object {$_.DisplayName -eq $GroupName}).ObjectId | Where-Object {$_.EmailAddress -eq $User}) {
                     [pscustomobject]@{
                        OldLicense = $OldLicense
                        NewLicense = $Licenses[$_].LicenseSKU
                     }
                  } 
    
              }
    
              if ($ChangeLicense) {
                    #The user were assigned to another group, switch license to the new one.
                    try {  
                          Set-MsolUserLicense -UserPrincipalName $User -RemoveLicenses $ChangeLicense.OldLicense -AddLicenses $ChangeLicense.NewLicense -ErrorAction Stop -WarningAction Stop
                          Write-Output "SUCCESS: Changed license for user $User from $($ChangeLicense.OldLicense) to $($ChangeLicense.NewLicense)"
                    } catch {  
                          Write-Warning "Error when changing license on $User`r`n$_"
                    }
                      
              } else {  
                               
                    #The user is no longer a member of any license group, remove license
                    Write-Warning "$User is not a member of any group, license will be removed... "
                    try {  
                          Set-MsolUserLicense -UserPrincipalName $User -RemoveLicenses $OldLicense -ErrorAction Stop -WarningAction Stop
                          Write-Output "SUCCESS: Removed $OldLicense for $User"
                    } catch {  
                          Write-Warning "Error when removing license on user`r`n$_"
                    }
              }
         }
    }
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

.SYNOPSIS

Script that assigns Office 365 licenses based on Group membership in WAAD.

.DESCRIPTION

The script assigns of licenses for new users based on groups/licenseSKUs in the $licenses hashtable.

It switch licensetype if a user is moved from one group to Another.

It removes the license if the user no longer is a member in any of the license assignment Groups.

Updated 2015-03-25 to support multiple skus for each user.

The script REQUIRES PowerShell 3.0 or later!

.NOTES

Author: Johan Dahlbom

Blog: 365lab.net

Email: johan[at]dahlbom.eu

The script are provided “AS IS” with no guarantees, no warranties, and they confer no rights.

#Import Required PowerShell Modules

Import-Module MSOnline

#Office 365 Admin Credentials

$CloudUsername = 'admin@365lab.net'

$CloudPassword = ConvertTo-SecureString 'Password' -AsPlainText -Force

$CloudCred = New-Object System.Management.Automation.PSCredential $CloudUsername, $CloudPassword

#Connect to Office 365

Connect-MsolService -Credential $CloudCred

$Licenses = @{

'E1' = @{

LicenseSKU = 'mstlabs:STANDARDPACK'

Group = 'E1_Users'

}

'E3' = @{

LicenseSKU = 'mstlabs:ENTERPRISEPACK'

Group = 'E3_Users'

}

$UsageLocation = 'FI'

#Get all currently licensed users and put them in a custom object

$LicensedUserDetails = Get-MsolUser -All | Where-Object {$_.IsLicensed -eq 'True'} | ForEach-Object {

[pscustomobject]@{

UserPrincipalName = $_.UserPrincipalName

License = $_.Licenses.AccountSkuId

}

#Create array for users to change or delete

$UsersToChangeOrDelete = @()

foreach ($license in $Licenses.Keys) {

#Get current group name and ObjectID from Hashtable

$GroupName = $Licenses[$license].Group

$GroupID = (Get-MsolGroup -All | Where-Object {$_.DisplayName -eq $GroupName}).ObjectId

$AccountSKU = Get-MsolAccountSku | Where-Object {$_.AccountSKUID -eq $Licenses[$license].LicenseSKU}

Write-Output "Checking for unlicensed $license users in group $GroupName with ObjectGuid $GroupID..."

#Get all members of the group in current scope

$GroupMembers = (Get-MsolGroupMember -GroupObjectId $GroupID -All).EmailAddress

#Get all already licensed users in current scope

$ActiveUsers = ($LicensedUserDetails | Where-Object {$_.License -eq $licenses[$license].LicenseSKU}).UserPrincipalName

$UsersToHandle = ''

if ($GroupMembers) {

if ($ActiveUsers) {

#Compare $Groupmembers and $Activeusers

#Users which are in the group but not licensed, will be added

#Users licensed, but not, will be evaluated for deletion or change of license

$UsersToHandle = Compare-Object -ReferenceObject $GroupMembers -DifferenceObject $ActiveUsers -ErrorAction SilentlyContinue -WarningAction SilentlyContinue

$UsersToAdd = ($UsersToHandle | Where-Object {$_.SideIndicator -eq '<='}).InputObject

$UsersToChangeOrDelete += ($UsersToHandle | Where-Object {$_.SideIndicator -eq '=>'}).InputObject

} else {

#No licenses currently assigned for the license in scope, assign licenses to all group members.

$UsersToAdd = $GroupMembers

}

} else {

Write-Warning "Group $GroupName is empty - will process removal or move of all users with license $($AccountSKU.AccountSkuId)"

#If no users are a member in the group, add them for deletion or change of license.

$UsersToChangeOrDelete += $ActiveUsers

}

#Check the amount of licenses left...

if ($AccountSKU.ActiveUnits - $AccountSKU.consumedunits -lt $UsersToAdd.Count) {

Write-Warning 'Not enough licenses for all users, please remove user licenses or buy more licenses'

}

foreach ($User in $UsersToAdd){

#Process all users for license assignment, if not already licensed with the SKU in order.

if ((Get-MsolUser -UserPrincipalName $User).Licenses.AccountSkuId -notcontains $AccountSku.AccountSkuId) {

try {

#Assign UsageLocation and License.

Set-MsolUser -UserPrincipalName $User -UsageLocation $UsageLocation -ErrorAction Stop -WarningAction Stop

Set-MsolUserLicense -UserPrincipalName $User -AddLicenses $AccountSKU.AccountSkuId -ErrorAction Stop -WarningAction Stop

Write-Output "SUCCESS: Licensed $User with $license"

} catch {

Write-Warning "Error when licensing $User"

}

#Process users for change or deletion

if ($UsersToChangeOrDelete -ne $null) {

foreach ($User in $UsersToChangeOrDelete) {

if ($user -ne $null) {

#Fetch users old license for later usage

$OldLicense = ($LicensedUserDetails | Where-Object {$_.UserPrincipalName -eq $User}).License

#Loop through to check if the user group assignment has been changed, and put the old and the new license in a custom object.

#Only one license group per user is currently supported.

$ChangeLicense = $Licenses.Keys | ForEach-Object {

$GroupName = $Licenses[$_].Group

if (Get-MsolGroupMember -All -GroupObjectId (Get-MsolGroup -All | Where-Object {$_.DisplayName -eq $GroupName}).ObjectId | Where-Object {$_.EmailAddress -eq $User}) {

[pscustomobject]@{

OldLicense = $OldLicense

NewLicense = $Licenses[$_].LicenseSKU

}

if ($ChangeLicense) {

#The user were assigned to another group, switch license to the new one.

try {

Set-MsolUserLicense -UserPrincipalName $User -RemoveLicenses $ChangeLicense.OldLicense -AddLicenses $ChangeLicense.NewLicense -ErrorAction Stop -WarningAction Stop

Write-Output "SUCCESS: Changed license for user $User from $($ChangeLicense.OldLicense) to $($ChangeLicense.NewLicense)"

} catch {

Write-Warning "Error when changing license on $User`r`n$_"

}

} else {

#The user is no longer a member of any license group, remove license

Write-Warning "$User is not a member of any group, license will be removed... "

try {

Set-MsolUserLicense -UserPrincipalName $User -RemoveLicenses $OldLicense -ErrorAction Stop -WarningAction Stop

Write-Output "SUCCESS: Removed $OldLicense for $User"

} catch {

Write-Warning "Error when removing license on user`r`n$_"

}

Migrate from Cloud identities to Azure AD Connect.

Posted by Harri Jaakkonen Posted on 31/03/2017 0 Comments

Posted in Azure, Onpremise, Powershell

Hi, Customer has working tenant with data inside and you need to convert it from Cloud-Only to Synced. It can be done with the following choices: UPN-matcing https://support.microsoft.com/en-us/help/3164442/how-to-use-upn-matching-for-identity-synchronization-in-office-365,-azure,-or-intune SMTP-matching http://www.ivchenko.pro/Blog/Post/23/Merging-on-premises-and-Office-365-users HARD-matching https://dirteam.com/dave/2014/08/15/fixing-office-365-dirsync-account-matching-issues/ Or by using little bit more effort and…

Java and Shibboleth authentication with Azure REST API and ADFS.

Posted by Harri Jaakkonen Posted on 31/03/2017 0 Comments

Posted in ADFS, Azure, Java, Shibboleth

The last blog entry was about setting up Onpremise AD with Office 365 and ADFS. So now to the instresting part. I’m going a little bit awol with this, as I’m not a coder. First about Azure authentication. https://docs.microsoft.com/en-us/azure/app-service-api/app-service-api-whats-changed#authentication And specially…

Enable or Disable Trace Logging in Dirsync and Azure AD Connect.

Posted by Harri Jaakkonen Posted on 21/01/2016 0 Comments

Posted in Azure, Office 365

The following page has all is needed. Steps to Enable Debug Tracing for Microsoft Online Services Sign-In Assistant Steps to Disable Debug Tracing for Microsoft Online Services Sign-In Assistant http://social.technet.microsoft.com/wiki/contents/articles/18103.microsoft-online-services-sign-in-assistant-how-to-enable-debug-tracing.aspx

Create UserPrincipalName attribute filter in AAD Connect.

Posted by Harri Jaakkonen Posted on 01/01/2016 0 Comments

Posted in Azure, Office 365

In AAD Connect it’s possible to sync only users with specific UserPrincipalName. And here is how to do it. Open Synchronization Rules Editor Under Rule Types click on Outbound. Find the rule named Out to AAD – User Join. Click…

The Enterprise Mobility Suite Portal Survival Guide.

Posted by Harri Jaakkonen Posted on 13/08/2015 0 Comments

Posted in Azure, EMS

Today I stumpled to this page. http://ronnydejong.com/2015/06/21/the-enterprise-management-suite-portal-survival-guide/ Must say I was impressed about the number of portals for Azure-services 🙂 Hopefully somebody else has also complained to Microsoft about the amount of active portal. And hopefully Microsoft will unify them…

Category: Azure

Top 10 actions to secure your environment

Office 365 Group and alias email-address.

Getting started with Windows Autopilot

Get a Msolusers with License details to seperate CSV-files.

Script that assigns Office 365 licenses based on Group membership.

Migrate from Cloud identities to Azure AD Connect.

Java and Shibboleth authentication with Azure REST API and ADFS.

Enable or Disable Trace Logging in Dirsync and Azure AD Connect.

Create UserPrincipalName attribute filter in AAD Connect.

The Enterprise Mobility Suite Portal Survival Guide.

Subscribe with RSS

Twitter

Archives

Subscribe with RSS

Categories

Twitter

Archives