Author: Adam Fowler

The Current State of Edgium

Posted on October 23, 2019November 26, 2020 by Adam Fowler

Update 16th Jan 2020: The New Edge is now live! You can download from here” https://www.microsoft.com/en-us/edge?form=MO12GC&OCID=MO12GC and more details here: https://blogs.windows.com/windowsexperience/2020/01/15/new-year-new-browser-the-new-microsoft-edge-is-out-of-preview-and-now-available-for-download/

Original Article:

“Edgium” or ‘The next version of Microsoft Edge’ is Microsoft’s rebuild of the Microsoft Edge browser, built on the open-source Chromium platform. I recently decided to start using it and see the current state of Edgium (which I’ll call it that for the rest of this post for clarification’s sake).

Microsoft Edge was met with a lot of resistance when launched – and although there were reasonable claims about it being the fastest browser around, there were a lot of features lacking and sites that wouldn’t work with it.

Here’s why Microsoft decided to abandon Edge as it is. It’s interesting to note that on mobile devices, they were already using an open-source foundation from the start, and for the desktop version there’s a focus on making sure all web standards are adopted.

You can download Microsoft Edge Beta right now and install it in parallel with the old Edge – or you can install the build that replaces old Edge direct from Microsoft here (keep in mind you can’t uninstall from this). The Beta is good if you want to have a play around before committing.

The expirience I’ve had so far is rock solid. There are some ways where it loosk and feels like Chrome, and others where it’s more Edgey. The import options (for me at least) just worked – I could import everything from browser history, favorites and saved passwords and pick which Chrome profile I wanted to import it from.

At the Edgium end, I’ve then created multiple profiles and imported each relevant profile across to match the experience I was having on Chrome. Multiple profiles is great when you’re doing things in Microsoft 365 and have multiple accounts (user and admin) and different tenants to access.

Also, Edgium fully supports Chrome extensions. Old Edge did have extensions too, but very few. Edgium will prompt, asking if you want to allow 3rd party extensions, and then you add them just like you would in Chrome:

The settings area of Edgium in my opinion, is much better than Chrome:

There’s also already Group Policy ADM/ADMX files ready to use which gives IT Administrators a lot of control over the browser, which is worth putting in place and going through before you even consider piloting Edgium.

For IT Admins, also check out the security baseline you should use, currently in draft form.

Edgium also has an Internet Explorer mode, so hopefully this can end up with Edgium replacing Chrome, Internet Explorer and Old Edge with a single browser – it might take a while of course, but for a company looking to control the user experience a bit more and not manage lots of browsers, it’s looking hopeful.

At the time of writing there’s no announced release date of Edgium, but it’s expected to completely replace Edge – so it’s worth getting used to it early. I’m sure there will be some changes between here and launch, but it should all be small changes.

Personally I’ve made the move from Chrome to Edge and haven’t hit an issue yet. Old Edge is on the way out, and overall this seems to be a positive decision for all involved. Let’s see how

Managing Unified Messaging Users in Exchange Online

Posted on October 18, 2019October 20, 2020 by Adam Fowler

error
The phone number you entered has already been registered by someone else.

This is the standard error you’ll see in the Exchange admin center when trying to enable Unified Messaging on an extension that already has it enabled.

When a user departs you’d expect that when you change the user mailbox to a shared mailbox and drop the licensing, Unified Messaging should go. However, in Exchange Online the mailbox will still be Unified Messaging (UM) enabled, and hang onto the extension it had.

You probably won’t even notice this until you go to enable UM on another mailbox using that same extension, which leads to the error at the top of this article.

The first challenge is to find the Shared Mailbox that is holding onto the extension. After connecting to Exchange Online in PowerShell, you can run this command:

get-ummailbox | select name, phonenumber | out-gridview

This will show a nice gridview of all your mailboxes and what UM extension they have. You can search/filter this view to find the cuplrit.

If you want to see which of your mailboxes are Shared and have UM enabled, run this command:

Get-Mailbox -RecipientTypeDetails SharedMailbox -ResultSize:Unlimited -filter {umenabled -eq "true"}

Knowing this mailbox, you’d expect it should be easy to turn off UM. This wouldn’t be too much of a problem if you could just disable UM like you can on a normal mailbox, but in Exchange admin center this isn’t an option at all when it’s a shared mailbox.

Trying to disable UM via PowerShell with the ‘Disable-UMMailbox’ command also won’t work, as you’ll get a license error:

License validation error: the action 'Disable-UMMailbox', 'Identity', can't be performed on the user 'Test User'
 with license 'BPOS_S_Standard'.
     + CategoryInfo          : NotSpecified: (:) [Disable-UMMailbox], RuleValidationException
     + FullyQualifiedErrorId : [Server=SYXPR01MB1901,RequestId=dfc62192-8270-4a65-b582-c7f327d6e7e2,TimeStamp=15/10/201
    9 6:24:33 AM] [FailureCategory=Cmdlet-RuleValidationException] DDB44050,Microsoft.Exchange.Management.Tasks.UM.Dis
   ableUMMailbox
     + PSComputerName        : outlook.office365.com

To fix this, you could use the Exchange admin center GUI along with the Microsoft 365 Portal, but it’s easier to run all the steps required via PowerShell:

First apply a license to the shared mailbox account that includes Exchange Online. You can see what licenses are available to you with this PowerShell command used by the MsolService cmdlet:

 Get-MsolAccountSku

Then, apply a license with this command against the shared mailbox and the AccountSkuID from the previous command:

Set-MsolUserLicense -UserPrincipalName "UPN OF SHARED MAILBOX" -AddLicenses "tenant:licensename"

Once applied, you’ll then need to change the mailbox to a Regular mailbox rather than Shared:

Set-Mailbox "UPN OF SHARED MAILBOX" -Type Regular

After a while, Unified Messaging may drop off by itself if you allocated a license that doesn’t support it (such as Exchange Online Plan 1 or Exchange Online Kiosk, or you can force it off with this command:

Disable-UMMailbox -Identity  "UPN OF SHARED MAILBOX"

Finally you can now enable UM on that other mailbox that was getting the error on the extension being in use. Easily done via the Exchange admin center GUI.

Two last steps are then to reverse what you did – take the license away from the shared mailbox, and make it a shared mailbox again:

Set-MsolUserLicense -UserPrincipalName "UPN OF SHARED MAILBOX" -RemoveLicenses "tenant:licensename"

Set-Mailbox "UPN OF SHARED MAILBOX" -Type Shared

Blocking ActiveSync with Conditional Access

Posted on September 27, 2019October 20, 2020 by Adam Fowler

Microsoft has announced that they’re continuing the path away from Legacy Authentication, with the decommission of legacy auth to EWS on Exchange Online on October 13th 2020. Instead of waiting for that looming date, there’s a bunch of security reasons to only have Modern Authentication for Microsoft 365.

I’ve already written up on Protect Your Office 365 Accounts By Disabling Basic Authentication and Blocking Legacy Authentication – Conditional Access vs Authentication Policies – but when I migrated from Authentication Policies to Conditional Access, I didn’t realise ActiveSync wasn’t included as part of blocking Legacy Authentication, even though it connects without MFA.

The guide from Microsoft on how to block Legacy Authentication doesn’t actually mention ActiveSync, so it’s easy to miss like I initially did! You’ll need to block ActiveSync altogether as far as I know, as it doesn’t support MFA.

Although I still think Conditional Access is easier to manage than Authentication Policies, there is one caveat; even with an ActiveSync block in place via Conditional Access, too many attempts by a user will lock their account briefly. This might cause problems or require work to get those users to clean up whatever device is trying to log in. With an Authentication Policy I don’t believe this happens because it’s blocked earlier in the sign-in process – you won’t see logs, and the account can’t get locked.

There is of course, a checkbox around ActiveSync, and a way to block it using Conditional Access, but I had mixed results in blocking it successfully until I did it exactly this way:

Create a new Conditional Access Policy and set these options:

Cloud apps or actions > Select Apps > Office 365 Exchange Online

Conditions > Client apps > Tick both ‘Mobile apps and desktop clients’ + ‘Exchange ActiveSync Clients’

In the Users and Groups section, you can narrow this down from ‘All Users’ for testing or for a gradual rollout.

The user experience is interesting on this one – they can still sort of authenticate, but instead of getting their emails, they will see a single email advising that their access has been blocked:

On top of this, you can use Azure AD to audit who might be using ActiveSync before you put any sort of block in place. As per usual, there’s a good Microsoft article on Discovering and blocking legacy authentication which can walk you through this, but in short:

Via the Azure Portal, go to Azure Active Directory > Users. Under Activity, go to Sign-ins. Click Add filters, and choose Client App > Tick the three ‘Exchange ActiveSync’ options and press ‘Apply’. You’ll see the last 7 days of sign in attempts using ActiveSync, which should give you an idea of how many users are using it, and who.

Blocking Legacy Authentication, plus blocking ActiveSync will give you a much more secure environment, protecting from account attacks.

MyAnalytics is Coming (for the rest of us)

Posted on September 19, 2019October 20, 2020 by Adam Fowler

MyAnalytics is an extension to Microsoft 365 which provides productivity insights. It looks at what you do over email, OneDrive for Business and Skype for Business Online/Teams, and collates the data to present it with statistics.

The documentation for how this product works is quite good and worth a read. There’s privacy considerations in any product that’s scraping data, but they seem fairly well addressed. Two main points are that the data for MyAnalytics is processed and stored in the user’s Exchange Online mailbox, and nobody but the user can see this data (including system administrators).

MyAnalytics has been around for a while, but mostly for Office 365 E5 / Microsoft 365 E5 customers so many people have not heard of it, or have no experience in it. Microsoft are changing who gets access to this data, and are currently rolling out Digest emails to E3, E1 and Business customers.

If you have the feature already turned on, then your users can probably already access their dashboard at https://myanalytics.microsoft.com/ and start checking it out.

MyAnalytics is controlled by a license under the Microsoft 365 product. Many people probably have all the components on, and therefore although users have had access to this product, it hasn’t really been visible. The Welcome email comes first, and it seems to be rolling out right now to Targeted Release users in Microsoft 365.

Beyond just turning MyAnalytics on, there’s a few admin controls available at the tenant level and user level. You’ll need to consider items like ‘should users be opted-in by default, or opted-out’ if there are concerns around data scraping – even though this all lives in your Microsoft tenant, there could still be staff that are not comfortable with this.

Nascar use MyAnalytics if that helps you point to another company using it:

As you can see, I’ve linked to a bunch of Microsoft documentation around this rather than rewriting what they have – always nice to see quality doco!

It’s worth checking out MyAnalytics now and deciding if it’s something you want – at least check the state of your settings before users start getting Welcome emails!

Update 20th September

The product group have advised me on one extra tip – disabling the ‘Weekly insights email‘ option at the admin end will actually disable the Welcome email too – documentation to be updated shortly.

Share this:

Share this:

Share this:

Share this:

Share this: