Working from home with Microsoft Teams: Taking Meetings Notes

Hi all,

Welcome back to my working from home with Microsoft Teams 30 second video series to help people that find themselves working from home for the first time with new technology.

Well you've worked out how to have a meeting? How do we take meeting notes? Let's check it out in Microsoft Teams!

Stay safe

@OliverMoazzezi

Working from home with Microsoft Teams: Adding additional participants to 1:1 chat

Hey everyone,

Today we'll talk about simply adding another user to 1:1 chat. New users will occasionally go to the extra effort of creating a new conversation, but in this video we show how Microsoft Teams takes care of that for you to streamline the experience whilst preserving the previous conversation.

Stay safe

@OliverMoazzezi

Working from home with Microsoft Teams: How do I record a meeting?

Welcome to day three. It's been an experience with three consistent days working from my temporary office at home - I advise to take two 30 minute breaks each day to get some fresh air. I find that helps enormously. Anyhow, how do I record a meeting in Microsoft Teams?

Stay safe

@OliverMoazzezi

Working from home with Microsoft Teams in 30 seconds: checking my audio device settings in a call

Hi all,

Day two and today we're checking our audio device settings once we have joined a call. Take a look in the video below.

Stay safe

@OliverMoazzezi

Working from home with Microsoft Teams in 30 seconds: Pinning contacts and notify when available!

As we are going through a pretty unprecedented time right now I thought I would try and put some Microsoft Teams in 30 seconds videos online with some top tips every week.

Here's day zero!

Stay safe!

@OliverMoazzezi

Enable Microsoft Information Protection (MIP) Label Preview for SharePoint Online and Microsoft Teams

Microsoft have announced the ability to classify an Office 365 Group via the creation of a SharePoint Online Team Site, or Microsoft Team with Unified Labelling.

This is a great feature to have, and effectively starts to really drive adoption of classification for these services - although the feature is in preview and still needs additional work to be a feature complete solution.

So how do you enable it for your tenancy? Let's take a look!

First of all ensure you have the latest preview version of the AzureAD PowerShell module. You can grab it here. For help on installing the module, see here.

Once you have the latest preview version of the AzureAD module then we'll all set to start making some configuration changes. We need to configure and enable 'EnableMIPLabels' for our Azure AD directory settings for the tenancy we're performing this work on. You can grab the below script from Microsoft here. Save this to a powershell file.

$setting=(Get-AzureADDirectorySetting | where -Property DisplayName -Value "Group.Unified" -EQ) if ($setting -eq $null) { $template = Get-AzureADDirectorySettingTemplate -Id 62375ab9-6b52-47ed-826b-58e47e0e304b $setting = $template.CreateDirectorySetting() $setting["EnableMIPLabels"] = "True" New-AzureADDirectorySetting -DirectorySetting $setting } else { $setting["EnableMIPLabels"] = "True" Set-AzureADDirectorySetting -Id $setting.Id -DirectorySetting $setting }


To check for the change, see the directory setting 'EnableMIPLabels' by running this command i Get-AzureADDirectorySetting -Id "62375ab9-6b52-47ed-826b-58e47e0e304b" | select -ExpandProperty values

You should see 'EnableMIPLabels' is now set to 'True'.

So what now? Well the truth of the matter is this change does take a little while to propagate across your tenant. I waited a few hours before I saw it working when creating SharePoint Online Team sites and Microsoft Teams.

So what's next? Well let's create a Unified Label specifically for this test. Go the the Security & Compliance Center and create a new sensitivity label.

You will see there's the new option to configure 'Site and group settings'

I have changed the defaults here to change the privacy to 'Private - only members can access the site', and I have disallowed external user access. I then save the label and push it to a label policy.


The label may take a while to show up. However when it does and the AzureAD directory settings have also invoked you should see this in Microsoft Teams when creating a new Team.

First of all you'll notice that I have the ability of selecting both a public and private team with the sensitivity label being set to 'none'.

Now see what happens if I select the label I created.

You can see Microsoft Teams immediately removes the ability for it to be Public based on the privacy settings applied to the unified label.

OK so if I go ahead and create the Team how can I easily see if there's a label applied? Well you'll see it applied in the top right hand corner of the client.

Can I add external users? If you remember I explicitly disallowed this in the unified label I created. Let's take a look.

You can see I get the same experience as if Azure Guest access isn't enabled. But it is. Let's take a look at another Team and try and add the same external user.

You can see it works just fine.

Similarly if I try and edit the settings of the Team to public from it's current private setting you'll see the label continues to push your compliance on the Team.

So what's SharePoint Online look like? Currently the sensitivity label support is only present in the SharePoint Admin Center when you create a new Team site, rather than directly in SharePoint Online for users to be able to take advantage of - like the current Microsoft Teams experience. Let's take a look.

Go to the SharePoint Admin Center | Sites | Active Sites and select 'Create'. When selecting a Team Site you will see under 'advanced settings' that sensitivity label support is now present.

Let's take a look with the Public label selected - you will notice the privacy settings are Public.

Versus my unified label where I specified Private.

So the Preview appears to be off to a flying start, but as stated more work is needed. Giving SharePoint Online the same end user creation capability for a Team Site with label that Microsoft Teams gets will be a welcome addition. And there's a fundamental issue where files aren't currently protected with the label that you set in the document stores, for example I can share files to an external user if I so wished, but I am sure these will be improvements that get baked into the functionality as it matures and comes out of Preview and generally available.

If this is all to much for your production tenant, then simply revert 'EnableMIPLabels' back to 'False'. I would suggest testing on a demo tenant to ensure you are happy if you want to enable and play with preview features.

Have fun!

@OliverMoazzezi

Working with Read Receipts in Microsoft Teams

Microsoft announced in July 2019 that Read Receipts would be coming to Teams. This roll out has been gradual and offers administrative control over the feature, as well as user control via the Teams client.

Microsoft MVP Tom Arbuthnot talks about the control of the Administrive side in his blog here, in this post i'll show you how the user experience looks for a user that has the feature enabled within their Teams client.


Your Teams client should inform you the feature is now available to you. It will be turned on by default so you will immediately benefit from the feature.

If you want to disable it, simply go to 'Settings' | 'Privacy' and you can disable it if you so wish.

If a user you are chatting with hasn't got the feature, even if they see your message your icon will only ever show as 'Sent'. Which is a little dissapointing. You can see in this shot the user has responsed and obviously seen my message but if they hadn't of responded I would have been none the wiser.

However a user that has been enabled for the service will have read receipts working in your favour. You can see from the below screen shots that the message goes from 'Sent', to the eye emoticon that designates 'Seen'.

The feature works well, although I expected it to work and provide receipt clarity on users that aren't using the feature, however I expect it will update and improve over time.

Have fun,

@OliverMoazzezi

Azure AD Registered Devices, Intune, Sync could not be Initiated (0x82ac019e) and Port 444

Greetings!

I've been very busy so a new blog post a little later than I really wanted to.. But this should help people that get the terrible error for Azure AD Registered Windows 10 devices of 'The sync could not be initiated (0x82ac019e)'.

Nearly every post on the internet for this error relates to an unlicensed user. However that's not actually always the case, in this instance it was a firewall configuration issue.

The device was Azure AD Registered by simply connecting a Work or School account to the device, however upon doing so and trying to force a 'sync'. This error presented itself.

Checking Event Viewer under | Applications and Services Logs | Microsoft | Windows | DeviceManagement-Enterprise-Diagnostics-Provider | Event ID 201 stated there was an issue registering succesfully.

Trying to get to the Azure AD registration url https://wip.mam.manage.microsoft.com:444 gave the following error.

Similarly after installing the Telnet Client the Windows 10 device couldn't open a connection.

This became evidentally clear that this was a port issue, most likely firewall related. After opening port 444 the Windows 10 device could talk successfully to https://wip.mam.manage.microsoft.com:444

and Event ID 209 showed a succesfully registration

And under | Settings | Accounts and sign-in | Connected Accounts | Info | If I selected 'Sync', it would now synchronise succesfully.

And my device was succesfully Azure AD registered!

As there were already succesfully Azure AD joined devices it became clear that there is a difference in the way both operate. Azure AD joined devices talk over port 443 which is almost always open on the firewall for outbound traffic.

Azure AD registered devices talk on port 444. You will most likely find this port is blocked in enterprise environments, and if it is, you'll need to open it.

Have fun,
@OliverMoazzezi

I have AADConnect Directory Synchronisation and users do not provision for Skype for Business Online

Just a quick one this morning. I recently I had an issue where a customer did not have users being provisioned for Skype for Business Online. The customer had remnants of a legacy Lync 2013 on-premises deployment and they were using AADConnect for directory synchronisation.

Digging in the tenant I could see that even with the Skype for Business Online license enabled, even after waiting several hours if I used Get-CsOnlineUser in the Skype for Business Online Management Shell, no users were there.

This led me to my good friend Jaap Wesselius Blog Post here - Aha, a possible eureka moment! This must be the issue. Unfortunately it wasn't, however it was this attribute that ultimately resolved the issue and led me to the resolution.

It appears since Jaap's post further logic and evolution has occured in the service, and these previous on-premises Lync enabled users could not be enabled for Skype for Business Online anymore using the above solution.

What I had to do was actually set the msRTCSIP-DeploymentLocator attribute to 'sipfed.online.lync.com' - once this was done the user would provision. Interesting as no previous Lync Hybrid deployment was in-place or had been attempted. It appears to be logic in the service for users that were previously enabled for Lync or Skype for Business on-premises.

Anyhow to cut a long story short, I wrote a little script to do this. I utilised a CSV file to import my users, as I didn't want to perform this operation across all user objects in the Active Directory. Similarly if you are planning to perform a cutover from on-premises Lync or Skype for Business rather than a Hybrid deployment and migration - again this will come in handy before you deprovision the users in the on-premises service. Just make sure you export the list of users via Get-CsUser first. Of course if you do plan on wanting to write across all user objects then substitute the first line "$users =" with Get-AdUser or similar rather than Import-CSV.

It's fairly self explanatory - And remember, even if you don't plan on using Skype for Business - be aware that Microsoft Teams still has some reliance on the service for services such as voice. So you will want to ensure there's no issues to provide your tenant and users a smooth Teams experience.

$users = Import-CSV -Path C:\yourfilehere.CSV
ForEach ($user in $users){
$u = $User.samaccountname -replace '"',''
Set-ADuser -Identity $u -Replace @{'msRTCSIP-DeploymentLocator' =  "sipfed.online.lync.com"}}

@OliverMoazzezi

Enabling Azure Information Protection Unified Labelling Preview

Microsoft currently have Unified Labelling in preview, but if you are looking at migrating your Azure Information Protection labels over to the Compliance Center what do you need to do?
First and foremost I would advise against do this in a real in-life tenant right now unless you are well prepared and ready for users to utilise it in Office.

Migrating the labels and having a Unified Labelling experience is one thing, but currently not all settings are migrated and you have to check each migrated label with care and attention - and reconfiguring the labels as and where necessary.

If you have a test Office 365 tenant however, this is a great place to test the unified experience to help plan for when the service becomes generally available, and will also allow you to test out the experience in Microsoft Office clients with the Unified Label plug-in.

So - how do we unify the label experience to help us plan for the change as a administrator for when Microsoft push this change to the service later in the year?

First things first, let's take a look at what's in the Compliance Center | Classifications | Labels. You will see these have now been split into 'Sensitivity' and 'Retention'.

In my test tenant, any previous labels I had created before this change would have been for Retention only, as Sensitivity was not an option. So you can see I have zero Sensitivity labels available.

So how do we migrate labels from the Azure Portal to Compliance Center? If we login to the Azure Portal and select Azure Information Protection, you'll see 'Unified labeling (Preview)' at the bottom of the blade. You'll see that it is a one way process and cannot be undone was activated, you'll see any labels with duplicate names across the service will be renamed (so best to check this, or test it out like I did). The one thing it doesn't state is not all your settings are migrated over! Which is pretty poor to be honest and something it should absolutely state You can read up about this further at this docs.microsoft.com AIP documentation.

Let's take a look and then activate.

Once activated you will see your AIP labels appear in Compliance Center under 'Sensitivity'.

So comparing the migrated labels you'll see some settings are migrated, and others are not. So make sure you verify each and every migrated label. However it is generally pretty good at carrying most things over. Confirm all protection settings and headers and footers to re-affirm your configuration settings.

You can see for example the encryption settings and users specified for a label have been carried over succesfully in this example label.

So once you have tested the experience, you now need to ensure you have downloaded and installed the unified label plug-in for Microsoft Office. It requires a specific version of .Net and there's a specific KB to install to allow it to work on Windows 7 machines. It also supports Office 2010 which is a surprise too - you'll find all the caveats to these here.

Have fun!

@OliverMoazzezi