Microsoft Teams As Your Ultimate Collaboration Hub

Microsoft Teams As Your Ultimate Collaboration Hub

There have been many instant messaging/chat applications attempting to take on business communication, and without a doubt, Microsoft’s Teams is the best yet.

This is in no small part fueled by the COVID-19 pandemic, which has seen Teams usage grow from 13 million daily active users in July 2019 to over 300 million in 2023.

In this article, we’ll see what Teams can do for your business communications and collaboration.

Meet Teams

A lot of development is going into Teams to make sure it’s the best place for groups of people to work together, the most recent evidence is the new Teams client application (public preview March 2023).

A Team can have up to 25,000 users but in my experience, it works best with smaller teams (up to a few hundred). If you’re delivering a webinar style event with people just watching, there’s a 20,000-attendee limit.

There are client applications for Windows, MacOS (both updated bi-weekly), iOS and Android as well as a web-based interface (updated weekly). Like many things in M365 there are two components to successful adoption, the technical side, and the user training side.

If you have conference rooms, make sure you consider the technology you outfit them with, Teams Rooms are a powerful way to use technology to connect staff in the office with staff working from home.

Teams Rooms are split into Basic (free, up to 25 systems can have this type of license) and Pro, which comes with many security, convenience and extra collaboration features. The old Teams Room Premium licensing has been retired.

Until recently there were just Teams licensing (as part of M365 licensing) and a free Teams for smaller teams (which is being retired). In February 2023 a new, paid for, licensing tier called Teams Premium became available.

As with any M365 feature set you need to carefully assess whether the additional features make business sense, for the users you license it for (not everyone needs to have Teams Premium).

Premium features include protected meetings with watermarks on recordings (with the email address of the person recording), sensitivity labels for meetings and end-to-end encryption, as well as custom meeting templates and themes.

For webinars there are a lot of extra features improving the overall experience, and finally virtual appointments manages these types of meetings, including SMS notifications.

Teams Phone

One great appeal of Teams is that you can connect it to the Public Switched Telephone Network (PSTN), allowing your users to call anyone in the world from their Teams client (on any platform) and have a phone number so anyone can call them.

This combination of external phone calls, internal VOIP / video calls and video conference meetings or webinars, easy file sharing and co-authoring, plus asynchronous Instant Messaging and chat is what has made Teams the de facto collaboration and communication hub in many businesses.

There are a few options on how to connect, and depending on your geographical location in the world not all will be available.

You can use Calling Plans, where Microsoft is effectively your telco provider or Operator Connect if your existing telco participates in the program and can facilitate the connectivity.

There’s also Phone Mobile where an existing telco uses SIM-enabled mobile phone numbers with Teams, and finally Direct Routing where you connect on-premises infrastructure to Teams. And in larger environments you may be using several of these in combination.

Managing Teams

Your main interface is the Teams Admin portal, and there’s a PowerShell module available.

Underneath each Team is an M365 Group (view more) with the chat messages stored in Azure table storage, shared files in the Team’s SharePoint library and personal files in each user’s OD4B, voicemail and calendars are stored in user’s Exchange mailboxes, and meeting recordings in Azure media services.

If you’re in a larger business, make sure to plan for governance of Teams early in your deployment. Visit your Tenant’s Team’s Guest access settings to make sure you have a good balance between security and collaboration for your business.

Another handy feature is the ability to use templates for Teams creation, including creating your own custom templates.

Each Team has a default General channel, and you can further create channels to organize communications, within each channel you can add tabs for Planner, OneNote, PowerBI, Stream, Wiki, websites and third-party apps.

To limit the proliferation of Teams in your organization you can limit who can create Teams (by default all users can), as well as use Private Channels in a Team.

You could have a Team for the Sales department with a private channel for only sales managers to discuss confidential information for instance. There’s also the ability to share a Channel with an external user, rather than sharing a whole Team.

The main benefit for the invited user is that they can be logged in with their own tenant account and access the shared channel chat and documents without the need to sign out and sign back into Teams using their guest account.

You can only create a new channel as a shared channel, you can’t convert a normal channel to a shared channel.

Delivering presentations using Teams is common, the PowerPoint Live feature makes it more interactive by allowing attendees to interact with the presentation at their own pace and Presenter mode gives you more control over how your presentation delivery shows up for the audience.

To practice your delivery (in PowerPoint in general), use Speaker Coach.

A great feature is breakout rooms. This lets you send users to or ask users to pick “rooms” where they can collaborate with a subset of the users in a Team during a meeting, and then return to the main meeting later.

Recordings of Teams meetings (including transcriptions) used to be stored in Stream, now they’re saved in OD4B / SharePoint where they can be shared easily (including with external attendees).

A good tip is being aware of the default expiry of meeting recordings: 120 days. You can change that (for recordings in your tenant) in the Teams admin center – Meetings – Meeting policies – Recording & transcription.

Speaking of transcriptions, if you have Teams Premium you can enable translated captions, so that a meeting delivered in English can be viewed by a German viewer with captions in their language, and another viewer can have captions in Chinese for example.

Using Teams

If you’re used to communicating via email here are some guidelines to be effective with Teams. Use @ mentions to draw something to the attention of a specific Team member, a channel or a whole team.

Be generous with your Praise when someone does something good for the Team, and if you want to acknowledge a message just Like it, instead of adding to the noise with a text-based reply.

When you’re about to post about something – check if there’s already a thread related to it and add to that instead and use the text styling (or a GIF / Sticker / Meme) when you want to get your point across and Sad, Angry or Happy reactions to contribute to the conversation when appropriate.

You can blur the background when you’re in a video meeting, or replace the background image and if you have frontline workers that need to communicate with others, use the Walkie Talkie push-to-talk feature.

You can also use an avatar to replace your video feed, handy for those Monday morning meetings when you’ve got a bad hair day, instead presenting a “cartoon” version of yourself.

Teams will automatically translate messages in other languages to the language set in your personal settings. And there’s offline functionality, so if you’re offline, Teams will save your unsent messages and send them when you’re back online.

When you’re in a meeting you can use Together mode which will show the video of each participant as if they were sitting in a lecture hall, removing the Brady bunch feel of the traditional grid of video feeds.

Viva

If you needed any more proof how central Teams has become to Microsoft’s vision and roadmap for modern collaboration and work, look no further than the Viva employee experience platform (EXP).

Viva has eight pillars, all surfaced in Teams: Viva Connections takes your SharePoint Online Home site, Line of Business (LOB) applications, and other internal news sources and lets you target company news and connections to the right people.

Viva Insights is the next iteration of My Analytics to help staff manage time and avoid burnout, integration with Headspace for guided meditations and a virtual commute function to wrap up the workday.

For Managers there’s a de-identified view to see how a team is fairing from a stress, mental health, and productivity point of view. There’s also a Leaders view for executives to see the overall state of their staff.

The third pillar is Viva Learning, surfacing training courses and microlearning content while integrating with other Learning Management Systems (Cornerstone OnDemand, Saba, SAP SuccessFactors and Workday) to make learning a natural part of everyone’s daily work.

Managers can schedule trainings and staff can share particularly good courses with each other and they’re all available directly in Teams.

Viva Topics builds on Cortex / Syntex and uses AI to organize company-wide content (in-house projects, products, acronyms) and staff expertise and surfacing this as topic cards / pages in Teams, Microsoft Search, SharePoint, and Office. Think of this as Wikipedia for your business.

Viva Goals applies the power of the objectives and key results (OKR) framework to help staff track their progress against goals.

Viva Engage on the other hand connects people across an organization (this is really the new name for what used to be Yammer).

The new Viva Sales integrates with any CRM (including of course Microsoft Dynamics 365) for deeper client insight and engagement.

And finally, Viva Pulse (in public preview at the time of writing) helps leaders and managers to receive and act on internal feedback in an organization.

As you can probably tell from these brief descriptions, most of the Viva modules are likely to find their homes in larger enterprises as that’s where the challenges of “managing people” at scale are most acutely felt.

Extending Teams

Another powerful capability is adding apps to Teams through the Teams Store. Microsoft tests and validates these apps.

There are hundreds of different apps for integrating with other platforms, enhancing productivity, improve meetings, customer relationship management (CRM) and many more.

A very popular app is Microsoft Whiteboard, free on all platforms, that you can use both inside Teams and standalone to brainstorm and plan together.

As an administrator you have granular control, you can allow or block apps, control the permissions they are given, manage how the apps are made available to users, plus report on app usage.

You can also have custom apps developed in-house. You can further extend Teams with Bots that can interact with your users naturally through chat or a notification bot that can push relevant information to your users.

With the advent of Slack (Team’s main competitor) and Teams many people have (again) proclaimed the death of email.

As usual we tend to see new technology as a direct replacement for the old while the reality is more nuanced. I find Teams more efficient for group-based work, the sharing of files and communication is superior to email but communication outside of client projects I’m involved in still relies on email.

And you can use email to send messages to a channel in a Team.

To properly protect your Microsoft 365 environment, use Hornetsecurity one-of-a-kind services:

To keep up with the latest Microsoft 365 articles and practices, visit our Hornetsecurity blog now.

Conclusion

In conclusion, Microsoft Teams stands out as the ultimate collaboration hub, particularly amid the COVID-19 pandemic. With its robust features and exponential user growth, Teams revolutionizes business communication and collaboration.

FAQ

How can you collaborate in Microsoft Teams?

Collaboration in Microsoft Teams involves:

  • Channels: Create channels for specific topics or projects.
  • Chat: Use direct messages or group chats for quick conversations.
  • Meetings: Schedule and conduct virtual meetings with audio and video.
  • Files: Share and collaborate on files in real-time using integrated apps like SharePoint.

Is Microsoft Teams good for collaboration?

Yes, Microsoft Teams is highly regarded for collaboration. It integrates chat, video conferencing, file sharing, and app integration, providing a centralized platform for team communication and cooperation. Teams can also integrate with phone systems in various ways, giving your Teams users a phone number so they can call anyone in the world.

How does Teams work collaboratively?

Teams work collaboratively by fostering communication, file sharing, and project management. Members can discuss in channels, collaborate on documents in real-time, and conduct meetings seamlessly. Integration with Microsoft 365 apps enhances collaborative workflows, making Teams a versatile platform for teamwork.

Maximizing Productivity with Office 365’s Other Apps

Maximizing Productivity with Office 365’s Other Apps

There are many other applications and services in the O365 portfolio. In this article, we’ll look at some of them with a brief introduction.

Planner

Microsoft has had Project for large scale project management for many years but for small to medium undertakings it’s overkill (there’s a steep learning curve) and this is where Planner shines.

If you’ve ever used Trello, you should be comfortable with Planner’s workflow. There’s a web-based interface, along with iOS and Android clients but no PC client. If you add a Planner tab to a Team, you can create a new plan or attach an existing one.

You organize tasks into buckets, assign tasks to different people and track the progress of those tasks. Tasks can also be viewed in a Schedule (calendar) view, and you can export a plan to Excel.

Other task management offerings from Microsoft includes To-Do (mobile, web and PC clients are available) which integrates with Outlook tasks.

Stream

This is the best way to share video inside your company and it’s similar to YouTube. There are clients for iOS and Android and a web interface but currently there’s no licensing in place for sharing videos with people outside your tenant.

When you upload a video it’ll be processed and if the people in it are speaking English, Chinese, French, German, Italian, Japanese, Portuguese, or Spanish it’ll automatically generate captions which are searchable in Stream, making it easy to find the right video or point in the video.

It’ll also attempt to recognize people in the video and if successful will list those people with the video information. Teams used to use Stream to store meeting recordings, but they’re now stored in OD4B / SharePoint.

Kaizala

This is an application like Teams, designed for frontline / transient workers with poor connectivity. Think of this as a managed version of WhatsApp.

PowerBI

Visualizing data is important for any modern business who wants to be data-driven and PowerBI is Microsoft’s answer. There’s a desktop client where you build your dashboards, there’s also a web interface.

Licensing is a bit of a challenge, depending on what you’ve built and who you want to share it with. It’s a lot of fun to use and the results can be extremely useful for many aspects of your business.

Power Automate

This deceptively simple, web-based tool is designed to automate tasks without having to write code (it used to be called Flow).

Simply drag in actions, connect them to external systems and schedule them to run regularly or be triggered by an event. There are lots of templates to help you get started as well as connectors to hook into Microsoft and third-party systems.

If you’ve used If This Then That or Zapier, Power Automate is easy to get started with.

PowerApps

Ever wished you could equip your staff with a custom mobile app to gather or access data in the field but realized the development costs were too high?

PowerApps is the solution, providing a low code / no code development environment to build applications that connect to SharePoint, Excel, O365, Dynamics 365 or SQL server on-premises or in the cloud; or the Dataverse platform.

The resulting app runs on iOS, Android, in a web browser or in Teams and SharePoint Online. If you need to manage data in your apps there’s Dataverse for Teams and the full Dataverse flavor.

Microsoft Lists

Yes, the old SharePoint list concept was given a new lease of life, including a separate app and is also available in Teams. Use it to track lists of “stuff” and manage information.

Microsoft Loop

Potentially the most confusing technology Microsoft has released in recent years (currently in public preview) is Loop.

The concept is fairly simple, you have Loop Components that you can embed in various locations, such as documents, Teams chats or an email, and these are kept in synch across these different places.

Loop pages lets you bring together components, links, tasks, and other data. Finally, Loop workspaces are shared spaces bringing pages and components together.

I find Loop most useful in the early stages of a project or an idea – brainstorm, work together with others on a concept and keep all ideas in synch with everyone you’re working with.

The challenge today is that due to the underlying storage of Loop components being in user’s personal OneDrive for Business, sharing outside an organization doesn’t really work, and even inside a tenant it can be a challenge.

If Microsoft can solve these challenges, Loop has an interesting future.

To properly protect your Microsoft 365 environment, use Hornetsecurity one-of-a-kind services:

To keep up with the latest Microsoft 365 articles and practices, visit our Hornetsecurity blog now.

Conclusion

In summary, Office 365’s additional applications provide diverse solutions for business needs, promoting productivity and collaboration. Leveraging these tools enables streamlined workflows and enhanced communication within organizations.

FAQ

What is Office 365 applications?

Office 365 applications refer to the suite of productivity tools and services offered by Microsoft as part of its cloud-based subscription service, Office 365. These applications cover a range of functions, including document creation, communication, collaboration, and more.

What programs does Office 365 have?

Office 365 includes a variety of programs, such as:

  • Word
  • Excel
  • PowerPoint
  • Outlook
  • OneNote
  • SharePoint
  • Teams
  • OneDrive
  • Exchange Online

And more, depending on the specific subscription plan.

What applications are in Microsoft Office?

Microsoft Office traditionally includes desktop applications like:

  • Word
  • Excel
  • PowerPoint
  • Outlook
  • Access
  • Publisher

The specific applications may vary based on the Office suite version, but these are common components. Office 365, as a subscription service, expands on this with additional online and collaborative tools.

Microsoft 365 Groups: Your Gateway to Efficiency

Microsoft 365 Groups: Your Gateway to Efficiency

M365 groups are a fundamental building block across different services. In this article, we’ll look at the diverse uses of them.

Group Types

An area that often confuses new O365 administrators is the different types of groups, here’s a short rundown to sort it out:

  • Microsoft 365 Groups
  • Distribution Groups (find more here)
  • Security Groups are used to grant access to resources
  • Mail-enabled Security Groups are also used to grant access and can also be emailed which will mean all members will receive a copy of the email
  • Shared Mailboxes (find more here)

While you can create Microsoft 365 Groups directly, you’re more likely to interact with them as a building block, providing a single identity for all of M365, that services such as Teams, Yammer and others use.

In addition, Outlook can use M365 groups, SharePoint Modern Team sites are built on them, and Stream and PowerBI use them to control access.

If configured thus you can write M365 Groups back to your on-premises AD where they manifest as distribution groups.

You can’t nest M365 Groups into other groups, and they can only contain actual M365 user accounts whilst Exchange Distribution groups can contain user accounts, mail users and contacts (see here).

Unless you’ve changed the defaults, any user in your tenant can create an M365 group which could lead to governance issues. You can instead designate users who can create groups.

You can also use various policy settings to control O365 Group behavior in your tenant, such as expiration policies to manage the lifecycle of groups and you can control the naming of groups through policy.

It’s easy to share content from within an M365 group with external users and M365 groups are also a shared repository of historical content as anyone who is a member can see all the content going back to when the group was first created.

It used to be that each licensed user in your tenant gave you five B2B guest licenses, and you could use one time passcodes for external guests who don’t have a Google, Microsoft Account (MSA) or an account in Azure AD.

That licensing model for external users has changed, Microsoft is bringing together Azure B2B and B2C (using Azure as a store for Consumer identities for your in-house developed application) and the new license model means each tenant can have up to 50,000 external users at no extra cost.

Note that guests have full access to all group content by default. You can control which domains external users have to be (or can’t be from) for external access.

Today when you create a group it’s private where the Owners of the group must approve a request to join, you can also make a group public where anyone can join.

You can change the tenant default which will ensure new groups are public or you can change the setting on a group after you’ve created it. Each group can have up to 100 owners and over 1000 users; an individual user cannot create more than 250 groups.

Like other constructs in M365 you have 30 days to restore a group once it’s been deleted while individual documents in the group are housed in the SharePoint recycle bin for 93 days.

Dynamic groups are a neat way to reduce the administrative overhead of managing group membership manually, based on queries of Entra ID attributes, although be aware that it requires Entra ID Premium P1 licensing.

To properly protect your Microsoft 365 environment, use Hornetsecurity one-of-a-kind services:

To keep up with the latest Microsoft 365 articles and practices, visit our Hornetsecurity blog now.

Conclusion

Microsoft 365 Groups serve as essential components across services, offering diverse functionalities and efficient collaboration.

FAQ

What is a Microsoft 365 Group?

A Microsoft 365 Group is a collection of people who have common tasks, responsibilities, and permissions. It facilitates collaboration by providing a shared mailbox, calendar, file repository, and access to shared resources within Microsoft 365 applications.

What is the difference between Groups and Teams in Office 365?

While Microsoft 365 groups provide collaboration features, Microsoft Teams is a communication and collaboration platform that leverages groups. Teams integrate chat, video conferencing, and file sharing within the group framework, offering a comprehensive collaboration experience.

Navigating OneDrive and SharePoint for Productivity

Navigating OneDrive and SharePoint for Productivity

Sharing files and providing an intranet platform is a core part of M365. Here, we’re looking at OneDrive for Business (OD4B) for personal file storage and sharing, as well as web-based collaboration in SharePoint.

OneDrive for Business

OD4B builds on SharePoint Online to provide each licensed user with their own document storage, 1TB for most SKUs.

This quota can be increased to 5 TB for certain licenses. Once you store files in OD4B, you can access them from any device through Android, iOS, Windows, MacOS, and web interface clients.

There are some limitations on file names, types, and sizes to be aware of. The OD4B sync client lets you see all the files you have synced on a device.

They can be in an Online-only state where you see them, but they’re not actually present on the device; when you open such a file, it’s downloaded and cached and thus locally available; a user can also pick one or more files to always keep on this device.

You can restrict synchronization to only domain joined devices.

To help users manage the contents of common folders you can use Known Folder Move (KFM) to synchronize the content of the Desktop, Documents and Pictures folders to OD4B and thus between devices.

SharePoint

If you’re an on-premises SharePoint administrator, you’ll be familiar with managing the underlying infrastructure of your servers as well as the complex web of sites and document workflows that end users consume on top of it.

Suppose you’re only now meeting SharePoint in the cloud for the first time. In that case, you’ll likely have a very different experience where you see SharePoint simply as the underlying document storage for other applications (Teams, Groups, Planner) and perhaps as the platform for your company’s intranet.

Building blocks in SharePoint are sites where content is stored, and you can control the layout, theme, navigation, and security with classic and modern flavors.

If you’re starting out or creating new sites, Modern sites are the way to go and there are a few different types available such as Communication sitesTeam sites and Hub sites.

Part of a larger vision for SharePoint, the modern sites and pages are very useful as they adapt to screen resolutions across smartphones and different size computer screens.

Search lets you find sites, files (including OneDrive for Business files), people and news content and if there are pictures in the content Artificial Intelligence (AI) will have extracted metadata and (if present) text content from those images.

If you have configured a hybrid deployment your on-premises documents will show up in the search results as well. Apps are add-ins / Web parts that expand the functionality of sites and Site collections are a way to group sites with a similar purpose together.

To set up different sites, use site templates to get you started. If you’re creating an intranet site, there’s an excellent Lookbook service with beautiful sites, providing modern experiences.

SharePoint Syntex is a technology that uses AI and ML to automate content processing and transforms content into knowledge. It understands your documents, processes forms and is applicable to large organizations with complex workflows and processes.

Be aware of the limits of SharePoint Online, particularly the total storage available which is 1 TB + 10 GB per license purchased. Search is an area that you want to spend some time customizing so your end users have a good experience.

Sharing is another area that you want to control as how users can share content internally and (critically) externally directly influences the balance between collaboration and security.

To properly protect your Microsoft 365 environment, use Hornetsecurity one-of-a-kind services: 

To keep up with the latest Microsoft 365 articles and practices, visit our Hornetsecurity blog now.

Conclusion

Migrating content from on-premises SharePoint Server and network file shares to M365 is the job of the SharePoint Migration Tool, as well as numerous third-party services.

If users accidentally delete files or ransomware has encrypted stored files you can use the Restore Files interface to restore files and folders or entire libraries from up to 30 days in the past.

There’s also the Recycle bin (93 days retention) for individual file restores and Restore Files for OneDrive.

FAQ

What is the difference between OneDrive for Business and SharePoint Online?

OneDrive for Business is a file storage service for individual business users, while SharePoint Online is a collaborative platform for team-based file sharing, document management, and intranet capabilities. OneDrive is more geared towards personal storage, while SharePoint supports broader team collaboration.

Do SharePoint and OneDrive work together?

Yes, SharePoint and OneDrive integrate seamlessly within the Microsoft 365 ecosystem. Files stored in OneDrive can be shared and accessed through SharePoint sites, promoting collaboration and ensuring consistency across individual and team-based work.

How do I sync OneDrive for Business with SharePoint?

To sync OneDrive for Business with SharePoint, open the SharePoint library, select “Sync,” and follow the prompts. This integrates your OneDrive and SharePoint files, allowing changes in either location to reflect in both, fostering collaboration and accessibility.

Streamlining Communication with Exchange Online

Streamlining Communication with Exchange Online

Email is the lifeblood of business communication, even in this age of Teams, Slack, and numerous other communication tools. It’s the lowest common denominator – the one tool that you can always use to reach someone if you’ve got their email address.

And email is a commodity – every business needs it, but no business is going to be more competitive by running it “more efficiently” than another.

It’s a Hybrid World

One of the strengths of M365 over Google Workplace, for instance, is the clear migration path from what you have today to the cloud because of Microsoft’s large footprint in corporate data centers around the world. If you have Exchange 2013+ on-premises, you can pick any of the migration methods, some of which provide a hybrid co-existence.

The full hybrid option lets you continue running your on-premises infrastructure for as long as you’d like and chapmove mailboxes in batches to the cloud on your own schedule. You can even move mailboxes back to on-premises should the need arise.

As you’d expect, there are many details to manage in a hybrid setup, including prerequisitesActiveSync connectivity, and mailbox permissions – especially when a user on-premises has permissions to a mailbox in the cloud or vice versa.

If all you’re looking for is a simple way to move mailboxes from Exchange to Exchange Online – Hornetsecurity has an excellent Mailbox Migration Tool.

Backup and Native Data Protection

One thing to realize about O365 is that Microsoft is going to make sure that you don’t lose your mailbox data, which they do through the native data protection in Exchange – keeping three copies of your mailbox data on separate servers, along with a “lagged copy” (behind in time, for instances where the data is corrupted rather than lost) on a fourth server.

They DON’T, however, keep backup copies of your data going back into the past, which may or may not be an issue for your business, depending on your regulatory needs. Several third-party services on the market will do backups of your Exchange and SharePoint online data. Hornetsecurity 365 Total Backup is an excellent backup solution for mailboxes, Teams, OneDrive for Business, SharePoint, and files on endpoints.

A deleted user account and mailbox can be recovered if no more than 30 days have passed.

Autodiscover

Whether your Exchange server is in the cloud or on-premises it’s important that client applications can find it – this is the job of the Autodiscover records in DNS. There are a number of other DNS records required for M365 – find them in this article. 

If you have a hybrid Exchange deployment the Autodiscover records need to point to your on-premises Exchange 2016/2019 Mailbox Server.

Managing Mailboxes

There are many tasks associated with mailbox management, one of them is quota management. F3 licenses get 2 GB quotas, E1 are set at 50 GB (with a 50 GB archive) and E3+ have 100 GB quotas with archive mailboxes that can be max 1.5 TB.

The difference between a mailbox and an archive mailbox is that the archive is only available when you’re online. You can control how much mailbox data is stored offline on each device with a slider in Outlook.

If you’re migrating large mailboxes to Office 365, ensure they’re smaller than 100 GB and no item is larger than 150 MB before starting the move.

In the Exchange console you can configure settings for a mailbox such as adding email aliases, see quota usage, control which clients (OWA, Unified Messaging) and the protocols (EAS, MAPI, IMAP and POP) the user can use, message retention and mailbox delegation.

This last option lets you configure other users to Send As emails as the user, Send on Behalf where the recipient can see that the email is sent on behalf of the user, and Full Access.

Mailbox Archive

As mentioned earlier you can enable an Archive mailbox for mailbox content which essentially serves as a “bottomless” storage area for older content, hopefully stopping users from adopting PST files as an archiving solution.

The Outlook mobile client (iOS and Android) cannot access Archive mailboxes. You can enable auto expanding archives for E3 and E5 licensed users using PowerShell:

Set-OrganizationConfig -AutoExpandingArchive

You can also enable Archive mailboxes on a per user basis. Note that the Archive folder that’s created in a mailbox when you right click an item and select archive isn’t related to the Archive mailbox.

Mail Forwarding

Be aware that users can set up their mailboxes to forward mail to an external email address (optionally delivering to both inboxes).

This is something you should keep an eye on because while there may be legitimate business reasons to forward mail, it’s also a favored attack vector for hackers where they silently read emails and then use that for various nefarious purposes.

There’s a report in the Mail Flow dashboard to show you what forwarding rules exist. You can also block users from being able to forward mail in several ways.

Shared Mailboxes

There are times when you’d like a mailbox that doesn’t “belong” to a particular user, such as sales or support, where you have a team of users accessing the same alias.

As long as the Shared mailbox doesn’t have a larger quota than 50 GB or uses an Archive mailbox, it won’t consume a license.

It’s also one option for handling staff that have left your company while you still need to monitor their email for incoming emails; converting their mailbox to a shared mailbox and assigning access to the appropriate staff will free up the license to be assigned to a new user.

From a security point of view, make sure direct login to shared mailboxes is blocked – users should only access shared mailboxes by adding them as an additional mailbox in Outlook.

Mail Contacts And Users

Both Mail Contacts and Users show up in All Contacts, the Global Address List (GAL), and the Offline Address Book (OAB). A contact is a pointer to an email address in an external system, whilst a user is also a pointer to an external address, but the user has O365 credentials to be able to access SharePoint Online or OneDrive for Business.

The latter is a remnant of on-premises Exchange, modern external sharing such as Teams, Planner, and others use Azure Business to Business (B2B) collaboration for guest access.

Distribution Lists

Grouping email addresses together to facilitate communication with teams of people is something that email systems have been doing for decades – in the Exchange Online Admin Center (EAC), you can create Distribution Lists (DL).

Note that the default is to create an M365 Group instead, and in fact, Microsoft is pushing to replace DLs with Groups.

Dynamic Groups make maintaining membership easier, basing the membership on an Entra ID attribute such as “department” – if that’s set to Marketing, for instance, the user is automatically included in the right group.

To properly protect your Microsoft 365 environment, use Hornetsecurity one-of-a-kind services: 

To keep up with the latest Microsoft 365 articles and practices, visit our Hornetsecurity blog now.

Conclusion

In summary, Exchange Online offers a seamless transition to cloud-based communication, providing robust data protection and efficient mailbox management.

Leveraging features like Autodiscover and mailbox archives, organizations can enhance productivity and streamline communication processes.

FAQ

How do I connect to Exchange Online in PowerShell?

Use the “Connect-ExchangeOnline” cmdlet in PowerShell. Install and import the Exchange Online PowerShell module, and then run the cmdlet to initiate a connection. Provide your credentials when prompted.

How do I connect to Exchange Server in PowerShell?

Utilize the “Connect-ExchangeServer” cmdlet. Ensure the Exchange Management Shell is installed. Run PowerShell as an administrator, import the module, and execute the cmdlet with appropriate server information.

How do I Connect to Office 365 in PowerShell?

Connect to Office 365 PowerShell using “Connect-AzureAD” and “Connect-MSOLService” for the MSOnline module. Provide credentials and follow prompts. Ensure modules are installed and updated for seamless connectivity; for more information, see here.

Integrating Azure AD with Microsoft 365

Integrating Azure AD with Microsoft 365

Behind M365 lies a directory which holds user accounts, groups, and other security objects. That was known as Azure Active Directory for many years, even though it had very little in common with Active Directory on-premises. Azure AD was renamed to Entra ID in July 2023. In this article, we’ll look at Entra ID and how you interact with it for M365.

Entra, Priva and Purview

Before we dive into Entra ID, let’s look at the new portal where you’ll be accessing it, entra.microsoft.com.

All identity-related services are housed here, whereas all Information governance-related features are in compliance.microsoft.com, called the Purview portal, and it’s got a section with all the privacy-related features called Priva.

Apart from Entra ID, the Entra portal also houses Entra Permissions Management, which inventories and right sizes of administrative permissions across Azure, AWS, and GCP (IaaS and PaaS) – not related to Microsoft 365 permissions.

There’s also a Verified ID that will help in the future with new hires and managing external identities, as well as Global Secure access. 

Meet Entra ID & Hybrid Identity

AD uses Kerberos and Group Policy, has a hierarchical structure, and is based on LDAP, none of which are cloud-friendly.

Entra ID operates over HTTPS, can be accessed from a REST API, and supports modern authentication protocols such as Security Assertion Markup Language (SAML), WS-Federation, and OpenID Connect for authentication and OAuth for authorization. It also supports federation, so you can connect it to other authentication systems.

There are three types of authentications supported in Entra ID:

  1. Cloud-based
  2. Directory synchronization
  3. Single Sign On (SSO) with AD FS

The first one is appropriate when you don’t have AD on-premises (or want to retire it) and create accounts in the cloud only. It’s definitely the simplest to configure. 

The other two require linking your on-premises AD to your Entra ID tenant through the free AAD Connect tool.

Before we dive into Entra ID, let’s look at the new portal where you’ll be accessing it, entra.microsoft.com. 

All identity-related services are housed here, whereas all Information governance-related features are in compliance.microsoft.com, called the Purview portal, and it’s got a section with all the privacy-related features called Priva.

Apart from Entra ID, the Entra portal also houses Entra Permissions Management, which inventories and right sizes of administrative permissions across Azure, AWS, and GCP (IaaS and PaaS) – not related to Microsoft 365 permissions.

There’s also a Verified ID that will help in the future with new hires and managing external identities, as well as Global Secure access.

AAD Connect – Your Umbilical Cord

AAD Connect (will presumably be renamed to Entra ID Connect) has had several predecessors over the years with different names – if you find an installation using DirSync or AAD Sync make sure to upgrade to AAD Connect as those tools are no longer supported. AAD Connect supports connecting multiple on-premises directories to AAD.

There was also version 1 generation of AAD Connect which is deprecated, you should be using version 2, which updates itself automatically. You can install the tool directly on a DC or on a member server.

There’s no true active / active HA option but you can set up a second installation of AAD Connect on a separate server in Staging mode and do a manual failover if the primary server is going to be offline for some time.

AAD Connect will synchronize user and group accounts in OUs you select (or the entire directory – not recommended) to Entra ID. You then assign licenses to those user accounts, and they can start using cloud services.

Note that this also means that on-premises is always the place to create new accounts and update, disable, or delete existing ones.

There are a few choices in how you handle passwords in AD. The simplest one is to use Password Hash Synchronization.

This gives your users SSO (even though technically it’s “same sign in” as the two user accounts are in two different directories). Another benefit of this method is that Microsoft can alert you when they find credentials on the web / dark web with accounts from your tenant where the passwords match.

If you’re adamant that your user’s passwords can’t be stored in the cloud (not even a hash of a hash), Pass-through authentication (PTA) is another option.

You set up agents on several (minimum 3, maximum 40) Windows Server 2012 R2+ servers (no inbound ports required) and when a user signs in at www.office.com for instance, Entra ID will verify that the correct password is supplied by communicating with your AD on-premises through the PTA agents.

Both PTA and Password hash sync optionally let you enable Seamless Single Sign On (Seamless SSO), where the user logs on to AD, and when they access www.office.com, they’re automatically logged in.

Both PTA and Password hash sync optionally let you enable Seamless Single Sign On (Seamless SSO), where the user logs on to AD, and when they access www.office.com, they’re automatically logged in.

A companion is AAD Connect Cloud Sync, which is configured from the cloud and only relies on lightweight agents on-premises, this also means you have High Availability built-in, as long as you deploy multiple agents.

Cloud Sync has slowly been gaining feature parity with AAD Connect and the main features missing today are support for device objects, the ability to sync from non-AD LDAP directories, PTA support, some filtering options and large groups with over 250,000 members.

The blocker for many though will that there’s no support for Exchange hybrid writeback. I expect Cloud Sync to eventually replace AAD Connect. The traditional way of not storing password hashes in the cloud is to use AD Federation Services (ADFS).

This is much more complex and requires several servers to be set up on-premises (or as VMs in Azure) but does offer more flexibility. If your organization has already deployed AD FS for other purposes, setting up federation with O365 is not a huge project but my (and Microsoft’s) recommendation is to stick with PTA or Password Hash Sync.

Given the SolarWinds supply chain breach and subsequent intrusion into various organizations using ADFS, along with Microsoft’s recommendation over the last few years to migrate from ADFS to Azure AD, if you have ADFS deployed, it’s time to make the move to Azure AD.

Azure MFA

One of the best things that Entra ID unlocks is the easy setup of Multi-Factor Authentication (MFA) for users.

Passwords are one of the weakest links in today’s IT landscape and the majority of the breaches we see are due to someone’s credentials being compromised. One solution to this problem is using MFA (sometimes known as 2FA or two-step authentication), where authentication requires not only a username and password but also a device or a biometric gesture to be present.

This drastically reduces (by 99%, according to Microsoft) the success of credential attacks.

MFA can call your phone, send a text message with a code, or send a notification / require a code from the free Microsoft Authenticator app. Unless absolutely required, do not use phone calls or SMS; they’re more insecure than the app options.

As a baseline, all your privileged accounts (Global / Exchange / SharePoint / Compliance administrators, etc.) MUST use MFA. This is free at all tiers of O365 and is simple to set up and the user experience is relatively seamless if you install the app on your smartphone.

If you’re an IT decision maker, expect to receive pushback from your administrators on this point but to maintain an acceptable security posture, this step is non-negotiable – all administrators HAVE TO use MFA.

As an aside, I’ve been using Azure MFA for my own business tenant and all my client’s tenants that I administer for many years now without issues.

You must however plan for times when Azure MFA is unavailable and this includes creating one (preferably two) Global Admin cloud accounts that are exempt from MFA and any CA policies.

These accounts should have very long and complex passwords that are only available to high-ranking administrators and should have monitoring enabled so that alerts go off if they’re ever used.

These broken glass / emergency access accounts should only be used to recover user access; for instance, if Entra ID MFA is down, you might turn off MFA requirements for the duration of the outage to enable users to log in and be productive.

Enabling MFA for your end users requires some planning and end user training. The level of tech familiarity your users have and whether they’re normally working from corporate offices influences how to implement MFA.

Administrators always get MFA for free; if you’re on the Business SKUs, MFA it’s built-in, but both lack the advanced features that Entra ID Premium P1 (M365 E3) or Entra ID Premium P2 (M365 E5) offer.

These include One-time bypass, Trusted IPs/Named locations; which lets you define corporate office IP address ranges where users will not be prompted for MFA. Note that all MFA levels let you (if you allow this feature) remember MFA on a trusted device for a set number of days (7-60).

If a user has logged on to a device and successfully performed MFA, they won’t be prompted on that device for the time period, and if the device is lost or stolen, either the user or you can “un-trust” these devices easily.

Starting in May 2023, Microsoft enabled number matching for all Microsoft Authenticator approvals, so instead of just pressing Approve or Reject, you must enter a two-digit code shown on your computer screen.

The app will also show you the geographical location from where the MFA request comes. Both features are designed to combat MFA fatigue attacks, where the attacker repeatedly tries to login, generating so many requests on your phone that some users simply press Approve to make it stop.

Microsoft now enables Security Defaults for all new tenants, and you can enable it manually for your existing tenants.

This will enforce MFA for all users and administrators using the Microsoft Authenticator app only, block legacy authentication, and control access to the Azure AD portal.

While these security enforcements are a good starting point for a small business with limited requirements, I advise caution for more complex organizations, as there’s no way to exclude break glass accounts or service accounts from MFA or ways to handle users who don’t have / can’t access the authenticator app on the phone.

Publishing Applications

One of the most powerful features of Entra ID is the ability to publish applications (third-party and on-premises) to your end users.

Take a corporate Twitter account, for instance, where several users have the username and password to send tweets on behalf of the company.

Not only will you need to reset the password as soon as someone leaves the company (you want them to refrain from tweeting as your organization after they’ve been fired) but you have little control over who else that password is shared with.

If you publish Twitter through Entra ID and create an AD group to put users in that should have access, you add a user account to that group, they’ll automatically have single-sign-on access to Twitter in the My Apps portal without ever knowing the password, and once they leave the company and their account is disabled, they can’t access it any longer.

For some of the 2400+ applications supported out of the box, you can even configure automatic provisioning so that when you add a user to the AD Salesforce group, an account is automatically created for them in Salesforce – again without them even knowing the password.

A popular option is using the AWS Single Sign-On app to integrate AAD and AWS.

Premium Features

Entra ID Premium P1 doesn’t just unlock more MFA features, it also allows you to ban commonly used passwords in your on-premises AD (including a custom word list), enable users to reset their own passwords when they have forgotten them, integrate MFA with Conditional Access and let users register for both MFA and self-service password reset (SSPR) in the same experience.

The P2 level adds the full experience of Entra Identity Protection where you get reports and can block authentications based on the risk level of the user account and the sign in or even trigger an “extra” MFA prompt based on the risk profile of the authentication attempt.

P2 also offers Privileged Identity Management (PIM) where you convert all administrative accounts to eligible accounts and users have to request elevation when they need to perform administrative tasks (known as “Just in Time administration”).

Instead of assigning administrative roles in Entra ID to individual user accounts you can now use groups to grant admin access.

The groups need to have a specific attribute set (isAssignableToRole) to true and static (rather than dynamic – automatically assigning user accounts to a group based on an attribute like “department” in the directory) user account membership.

Where AD has a hierarchical structure, relying on Organizational Units (OUs) to structure your user, machine and group accounts based on department, geography, or other approach, Entra ID is a flat structure.

Administrative Units (AUs) is a feature that aims to change this, using AUs you can structure user and group accounts and then delegate administrative permissions to a single AU or AUs. The AU admins need Entra ID Premium licensing.

Note that unlike OUs where an account can only be in a single OU, a group or user account can be a member of multiple AUs (up to 30).

If you have a large environment and Premium P2 licenses, consider using entitlement management, a way to group application, group membership (including Teams) and site access into a single access package.

These are useful for internal users (“you are the new person in Marketing – here’s your package that gives you all the access you need”) and can also be used to grant access to external users.

For partner organizations that you work with frequently you can even set it up so that their users can apply for packages, self-service style. Entitlement management can also get IT out of the role of assigning permissions by delegating package assignment to business users.

Conditional Access Policies

Both P1 and P2 unlocks another powerful feature in Entra ID, Conditional Access (CA).

This lets you build policies around application access (both cloud an on-premises applications) based on the user account and what groups they’re a member of, which application they’re accessing, the state of their device, their location, the sign-in risk and which type of client application they’re accessing it from.

These “if this – then do that” rules greatly enhance the security of your data by managing risk factors affecting identity and access in M365. Making it even easier to set up good CA policies are templates (in preview at the time of writing) covering Secure Foundation, Zero Trust, Remote work, Protecting administrators, and Emerging threats.

To make sure you don’t create a policy by mistake that locks out the CEO five minutes before his board presentation, the option to deploy CA policies in Report-only mode lets you evaluate the impact the policies will have without actually enforcing them.

There’s an API for accessing CA policies. This makes it possible to backup (using PowerShell for example) your CA policies, restore them, monitor changes, and treat them as code rather than manually manage them in the portal.

You could also test policies in a test tenant before exporting them from there and importing them in your production tenant after they pass validation.

Managing the Account Lifecycle

Once you implement AAD Connect, make sure you update your process documentation to consider the full lifecycle of user accounts, such as making sure they’re given the right licenses, are added to the right groups, and when the time comes to disable the account, the right steps are followed.

To make sure that users (and guests) don’t accumulate access that they no longer need, use Access Reviews (Premium P2), which now lets you review all guest accounts in one operation rather than on a per Team/M365 Group basis.

For a smaller O365 or M365 tenant, chances are you’ll never even need to go to the full Azure AD portal, and instead, you’ll do your user management in the M365 portal. However, it is a good idea, to explore the “full” Entra portal over at https://entra.microsoft.com.

If you’re keen to try out upcoming features in Entra ID, use the Preview hub to learn about and turn on public preview features.

To properly protect your Microsoft 365 environment, use Hornetsecurity one-of-a-kind services: 

To keep up with the latest Microsoft 365 articles and practices, visit our Hornetsecurity blog now.

Conclusion

In conclusion, the transition from Azure Active Directory to Entra ID in Microsoft 365 marks a significant shift towards modern authentication and enhanced security. Entra ID offers robust features such as multi-factor authentication, application publishing, and conditional access policies, making it a pivotal component of M365’s identity management framework.

FAQ

Does Microsoft 365 include Entra ID (Azure AD)?

Yes, Office 365 & Microsoft 365 includes Entra ID, formerly Azure Active Directory (Azure AD). Entra ID is the identity and access management service used by Microsoft 365 for user authentication and authorization.

What is a Microsoft 365 group in Azure AD?

A Microsoft 365 group in Azure AD is a security group with an associated email address and shared resources. It simplifies collaboration by granting members access to shared applications, data, and conversations.  

Is Microsoft Entra ID free?

Azure AD offers both free and premium plans. The free plan provides essential identity and access management features, while premium plans offer additional capabilities such as Conditional Access policies, advanced security features and self-service identity management.