SuperTekBoy

Practical Help for Exchange & Office 365

Office 365 Tutorials

How to create an Office 365 mailbox (in hybrid)

By 14 Comments

111 Shares
Share
Tweet
Share
Reddit
Email

When a company has implemented Exchange hybrid and has moved some or all their users to Office 365, the question “How do I create a mailbox in Office 365?” frequently comes up.

In this article, we explore how to create a mailbox in Exchange Online when directory synchronization is in place. For this article, we will explore this process using Exchange 2016. We will look at how to complete this task with the GUI and PowerShell. Note that these steps are identical for Exchange 2013.

Using the Exchange Admin Center

This is the simplest and quickest way to create a mailbox in Office 365. The drawback to this solution is that it only allows you to create an entirely new Active Directory user. A preexisting user without a mailbox cannot be enabled for an Office 365 mailbox using the GUI. To grant an existing user an Office 365 mailbox you will need to use PowerShell. Alternatively, that user could be given an on-prem mailbox and then move that mailbox to Office 365.

If your current process is to create a new account in Active Directory first and then enable the mailbox in Exchange second, I would recommend reversing these steps. Using the method below allows you to create a basic user in Active Directory with a mailbox in Office 365. Then you can go back into Active Directory to make any additional changes to the new account, such as group memberships.

For our example, we are going to create a new user called Wilfred Mott who will have a mailbox in Office 365. Wilfred does not currently have a user account in Active Directory so we can use this method. Wilfred’s email will be wilfred.mott@exchangeservergeek.com.

From your on-premises Exchange 2016 server, log into the Exchange Admin Center. Select the Recipients tab and Mailboxes sub tab. Click the New (plus sign) and select Office 365 mailbox.

Note: If you do not see this option you may be missing the required RBAC permissions, or, there is an issue with your hybrid configuration.

Create a new Office 365 mailbox

Selecting this option walks you through the process of creating a remote mailbox in Office 365. The benefit here is that you do not need to migrate the mailbox after it is created as it already exists as an object in the cloud. Keep in mind that you will not see this mailbox in the Office 365 tenant until directory synchronization has run. [Read more…] about How to create an Office 365 mailbox (in hybrid)

Changing the meeting layout in Skype for Business

By 5 Comments

65 Shares
Share
Tweet
Share
Reddit
Email

When you enter a Skype for Business meeting it is launched in speaker view. Speaker view adds the portrait of the presenter to the lower right of the screen. The portrait will change to whoever is currently speaking. This view is especially useful when the presenter is using a webcam as the picture is replaced with their video stream. Unfortunately, this can cover part of the presentation as shown below. This view can be changed but the option to do so is not in an intuitive location. In total there are three views for a Skype meeting. In this article, we will look at all three and how to switch between them.

Skype for Business Speaker View

To change from speaker view we use the Pick a Layout button (  ). This button is located at the top right of the screen in the title bar. If you select this button a checkmark will indicate what view you are currently in. In our case, we are in Speaker View. To pick another view select it from the list. [Read more…] about Changing the meeting layout in Skype for Business

Change the notification email for directory synchronization failures

By 3 Comments

153 Shares
Share
Tweet
Share
Reddit
Email

In this article, we explore how to change the email address that receives the Office 365 directory synchronization failure notifications. We will explore how to do this with PowerShell.

Let’s get started!

Getting connected

First, you will need to have access to the Windows Azure Active Directory Module for Windows PowerShell. An article detailing how to install this module and all prerequisites can be found here.

You should have an icon on your desktop named Windows Azure Active Directory Module for Windows PowerShell. Right click on this icon and select Run As Administrator from the context menu.

Windows Azure Active Directory Module for Windows PowerShell Icon

At the PowerShell prompt enter the following command and hit enter.

 C:\> Set-ExecutionPolicy –ExecutionPolicy RemoteSigned

Execution Policy Change
The execution policy helps protect you from scripts that you do not trust. Changing the execution policy might expose you to the security risks described in the
about_Execution_Policies help topic at http://go.microsoft.com/fwlink/?LinkID=135170. Do you want to change the execution policy?
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "N"):

Press Y for yes and hit Enter. [Read more…] about Change the notification email for directory synchronization failures

Enable explicit DKIM signing in Office 365

By 18 Comments

178 Shares
Share
Tweet
Share
Reddit
Email

In this article, we will take a look at how to enable explicit DKIM signing in Office 365.

What exactly is DKIM?

DomainKeys Identified Mail (DKIM) is an email authentication mechanism designed to prevent email spoofing. DKIM utilizes a cryptographic key pair and DNS records to provide sender validation and message integrity. It does this in the following way.

DKIM

The sender encrypts selected parts of the message header with its private key. This is defined by the “h” field in the diagram above. In our example, we are encrypting the From, To, and Subject fields to name a few. Portions or all of the messaged body may also be hashed. The DKIM header itself is not encrypted. In the DKIM header, the “d” value identifies the sender domain. The “s” value identifies a unique selector defined by the sender.

The recipient combines the selector and domain values to form a DNS query. Using our diagram above the domain field is marked as supertekboy.com and the selector field is marked as selector1. Using these values the recipient forms the following DNS query.

selector1._domainkey.supertekboy.com

The _domainkey portion of the query is a fixed part of the protocol.

The name servers for the sender respond with a TXT record containing the public key. The recipient can then use this public key to decrypt the header (and any parts of the body).

Successful decryption validates the sender. A DKIM=Pass is attached to the message header which increases the confidence level of the message.

One of the drawbacks of DKIM is that it doesn’t prevent against close misspellings of a domain. For example, I could register supertecboy.com and configure DKIM signing. DKIM will pass because the messages are coming from supertecboy.com. But to an untrained eye, supertekboy.com and supertecboy.com might be considered the same entity. When in fact the latter is a spoofer. [Read more…] about Enable explicit DKIM signing in Office 365

Add a legal disclaimer to all outbound email (Exchange/O365)

By 6 Comments

86 Shares
Share
Tweet
Share
Reddit
Email

Adding a legal disclaimer to all outbound email is an important task. Thankfully, this is a simple process in Exchange on-premises and Office 365. In fact, the instructions are identical for Exchange 2013, Exchange 2016 and Office 365.

For this article, our example company, Time Travel Research, wishes that all email leaving the organization have a legal disclaimer. Time Travel Research is not concerned about applying a disclaimer if the message remains inside the organization. For example, a disclaimer between two employees is not necessary. However, they would like all external messages, whether it be to a customer or a vendor, to have this disclaimer.

Let’s get started!

Add a legal disclaimer to all outbound email

Log into the Exchange Admin Center. Once logged in, navigate to Mail Flow >> Rules. Click the New (Excchange 2016 New) button.

From the drop-down menu, you will notice several choices. These choices are rule templates. We could just select Create a new rule. That would start us with a blank rule with no conditions. However, to give us a head start lets pick the Apply disclaimers template. This will configure a couple of items for us.

Add a legal disclaimer to all outbound email Exchange Office 365

[Read more…] about Add a legal disclaimer to all outbound email (Exchange/O365)

Don’t feed the Phish

By Leave a Comment

36 Shares
Share
Tweet
Share
Reddit
Email

This morning I woke up to a very interesting phishing email. I never blog about phishing attacks but I found this one particularly interesting as it was spoofing Microsoft account services.

Identify the Phish

Phishing emails are always getting more creative. Sometimes it is hard to spot a fake from a legitimate email. But there are always a couple of tells on a fake email. The one I received this morning had a few.

Outlook.com Microsoft Team Phishing Attack

The first was the email address. Despite it displaying outlook.com the part to the left of the at symbol read “outlooo.teeam”. This was the first red flag.

The second red flag is the sketchy use of the English language throughout the body of the message itself. It just doesn’t read well.

Then comes the Verify Your Account button. This was the ultimate red flag. Without clicking I hovered my mouse pointer over the button. It revealed where it was going to take me. Even if the email address had been formatted better and the body of the message was grammatically correct the link was the surefire tell. In the screenshot above I superimposed the link so you can see where it was taking me. Clearly not a Microsoft site. But some site in India.

The final red flag was the trademark symbol at the end of the message. I have no idea why the word “team” (or perhaps the entire phrase) is a trademark.

Now that we have identified a phishing email what’s next? I recommend reporting it to your anti-spam provider. Below are the steps for reporting it to Microsoft. If you have a 3rd party vendor for spam, check with your system admin on how to submit messages to them for analysis. [Read more…] about Don’t feed the Phish

Easily Connect to Exchange Online with PowerShell

By 8 Comments

62 Shares
Share
Tweet
Share
Reddit
Email
Exchange Online with PowerShell

In a previous article, I explained how to connect to Office 365 with PowerShell. In this article, we explore how to use PowerShell to connect to Exchange Online. This can vary based on what authentication method you have configured for your admin account. The sections below cover each authentication method.

  1. If your admin account has MFA enabled
  2. If your admin account has MFA disabled
  3. If you are using ADFS (SSO)
  4. Prereqs for older operating systems
  5. Let’s script this instead

Let’s get started!

If your admin account has MFA enabled

If your administrator account has multi-factor authentication enabled you won’t be able to use the built-in PowerShell. Instead, you will need to download the Exchange Online PowerShell Module.

To do this, log into the Office 365 Admin Center, navigate to the Exchange Admin Center, and click the Hybrid tab.

From the hybrid tab, click the second Configure button (under the text that states The Exchange Online PowerShell Module supports multi-factor authentication).

Exchange Online PowerShell Module - Multi-factor Authentication

Note: You can only download this with Internet Explorer. This module will error out if you use Chrome or Firefox.

This will create a new icon on your desktop named Microsoft Exchange Online Powershell Module. Double-click Microsoft Exchange Online Powershell Module.

Exchange Online PowerShell Module - Multi-factor Authentication A

This will launch PowerShell with the Exchange Online Module preloaded. To connect we will use the Connect-EXOPSSession cmdlet. In this cmdlet swap the -UserPrincipleName parameter for your administrator’s login name.

 C:\> Connect-EXOPSSession -UserPrincipalName globaladmin@contoso.com

This command should launch a web pop-up. Enter your Password and click Sign in.

Exchange Online PowerShell Module - Multi-factor Authentication C
[Read more…] about Easily Connect to Exchange Online with PowerShell

Office 365: Set Passwords To Never Expire

By 1 Comment

3 Shares
Share
Tweet
Share
Reddit
Email

If you have ever tried to tweak the password policy in Office365 then you have likely encountered this warning.

Office365 Admin Center Password Expiration
Office365 Admin Center Password Expiration

Unfortunately, this restricts us to a password that can never be used for more than 730 days (2 years). Anything outside that range and you receive an error like the one above.

Does this mean that a password must expire?

Well, no, it does not have to.

Now password expiration is a best practice but, you may have a situation that necessitates having a more permanent password. One such example could be a service account for a network copier. The copier would use this account to perform scan-to-email functions. A user would scan a hardcopy of a document into the scanner and send it to email leveraging Office 365.

Most likely, you are never going to log with the scanner account. This means you will never see the expiration notice. You could set up a calendar reminder for yourself. You could also plaster your monitor with sticky notes. But, more than likely, your scan-to-email will break one day and leave you scratching your head as to why.

So, how do you set a password to never expire? The Admin Center gives you an error. So, what is left?

[Read more…] about Office 365: Set Passwords To Never Expire