Since the dawn of time (or at least, since the dawn of the Epoch), people have been inadvertently deleting stuff. As is attributed to Uncle Ben, “with great power comes great responsibility,” and so it is true with the system administrator. … [ Continue reading ]
Updated Tool Roundup!
Over the last couple of days, I’ve updated a few tools that I have published on the gallery. Here’s the run-down:
AAD Connect Network and Name Resolution Test
I’ve been busy with this tool a lot lately, both adding tests and tweaking the way things are done. … [ Continue reading ]
Export Exchange Online Client Access Report
So, imagine this:
The security team comes to you and asks you for a report on how people are accessing Exchange Online services–browser, mobile, Outlook client. In the olden days of Exchange on-premises, you could look at the IIS logs to check browser traffic. … [ Continue reading ]
Office 365 Groups and Anonymous External Senders
I have created a more detailed example of how to do this here: https://bhr.62e.myftpupload.com/2018/09/14/fixing-office-365-anonymous-group-write-back-and-external-delivery/
Office 365 Groups are glorious creations. There are, however, some instances where they don’t work as you anticipate (or hope). One of those scenarios is when you are configured in hybrid coexistence with the following scenario:
- Office 365 Group Writeback is enabled (for configuring permissions, see this script)
- RequireSenderAuthenticationEnabled is set to False for an Office 365 group
- Your organization’s MX record is configured to point on-premises
In this scenario, external emails sent to Office 365 groups (via your organization’s MX record pointing on-premises) will be returned with one of our favorite NDRs:
“You do not have permission to send to this recipient.”… [ Continue reading ]
Block direct delivery to @onmicrosoft.com addresses in a hybrid environment
UPDATE: [11/20/2018] I had an error in the transport rule configuration in the last example, as well as a note that a TR would NDR external traffic. I have this post accordingly.
We’re all familiar with how Office 365 tenants work–when you spin up a new Office 365 tenant, you get a managed domain (tenant.onmicrosoft.com). … [ Continue reading ]
Detecting Outlook / Exchange data exfiltration
*Updated 2021-11-29 with new links to the Audit Scripts*
While I was working on a script to configure Office 365 Secure Score settings, I came up with a few scripts that I thought would be helpful in monitoring your messaging environments. … [ Continue reading ]
Update to Wipe Exchange Online Mailbox script
Earlier today, I was asked to make an update to my script to wipe Exchange Online mailboxes to include Archive Mailboxes. Fortunately, it ended up being much easier than I anticipated:
When I enumerated the mailbox originally, I used:
$Root = [Microsoft.Exchange.WebServices.Data.Folder]::Bind($service,… [ Continue reading ]
Manage Office 365 Distribution Groups via Excel spreadsheet or CSV
A consultant friend of mine posed an interesting question to me this week–one of his customers wanted to be able to let his users administer a cloud-managed Office 365 distribution group by uploading a CSV or Excel spreadsheet. From an administration perspective, I have done an incredible amount of directory management tasks using CSVs, so this didn’t seem like that difficult of a task.… [ Continue reading ]
Disable Office 365 Groups Creation: Redux
Update: I posted roll-back steps at the bottom of the article.
Several months ago, I wrote a blog on Disabling Office 365 Groups. It seems as though we couldn’t leave well enough alone. Such is a price of progress.
I got a new laptop a few weeks ago, and then found myself in the position of helping out a few colleagues this week. … [ Continue reading ]
Migrating Hybrid Public Folders to Office 365
Update: Shameless plug: I’ve written more extensively about public folder migrations from both the 2007/2010 and 2013/2016 perspectives in the book, “Office 365 Administration: Inside Out,” available at http://aka.ms/thebookonit.
So, tonight I started the last phase of one of my longest-running projects since joining Microsoft–an Exchange Online migration for a school district that I began nearly a year and a half ago. … [ Continue reading ]
Troubleshooting Mailbox Migration Error “You can’t use the domain because it’s not an accepted domain for your organization.”
While migrating users via MRS between organizations (especially to Exchange Online), a pretty common error that I run across is:
You can’t use the domain because it’s not an accepted domain for your organization.
This error is generated because the MailUser object of the user you’re attempting to migrate has a proxy address attached to it that is NOT an accepted domain in your target organization or tenant.… [ Continue reading ]
Removing Proxy Addresses from Exchange Recipients
This script and the accompanying post have been updated.
I saw a request come through the other day for a method to remove unwanted proxy addresses for contacts. I’d had some code sitting around from a project a few years back and decided to freshen it up, and maybe add some newer tricks.… [ Continue reading ]
Migrating EOP Settings Between Tenants
I find myself currently writing tools to both support my and other organization projects, as well as looking for ways to refine existing tools and scripts, make my life easier for future migrations, and provide additional resources to the community to help other customers more successfully use our products.… [ Continue reading ]
Export and Import Calendar Processing Information
UPDATE: The final script has been relocated to the PowerShell Gallery: https://www.powershellgallery.com/packages/ExportImport-CalendarProcessing/5.1
During my current project, it became necessary to capture additional calendar processing parameters that are not preserved during a normal hybrid move–such as booking policies.
Some of the challenges that I faced in customer environments when writing this tool:
- Blank or unpopulated attributes
- Conversion of sAMAccountName values to PrimarySmtpAddress
- Multiline attributes with special characters
- Attributes that were set for the wrong recipient type
The first thoughts I have when building a tool generally involve four concepts:
- What data do I need to gather/export
- What format is the source data
- What format do I need to save it in
- How do restore/import that data back into the target?
Fix those IMCEAEX NDRs
I had a customer migrate some mailboxes a few weeks ago, and they’re now just getting some NDRs. Here’s a sample NDR:

To fix this, you can take the NDR that you receive, copy/paste it into this function, and then take the resultant decoded x500 address and add it back to the proxyAddress array for the recipient.… [ Continue reading ]
