The Microsoft 365 Apps admin center is a very interesting take on cloud management for Apps for Enterprise (Office on the Windows desktop).  

Instead of managing the customization settings using the Office Deployment Tool (ODT), you use the cloud portal to create the required XML files. The Apps admin center does so much more, however. 

It inventories your Office installations across your tenant, tracks which versions and build numbers are installed and which ones are out of support, and lets you build Servicing Profiles to deploy newer versions of Office. 

It also uses Security Policy Advisor to analyze current usage of the apps and allows you to create and deploy policy configurations to all Apps for Enterprise installations (without relying on GPOs or MDM), plus tracks which add-ins are in use across all your devices.  

Suppose you have a large number of users. In that case, you may want to turn off the option for users to download Apps for enterprise from www.office.com (M365 portal – Settings – Services & add-ins – Office software download settings) and instead deploy it using your favorite method. 

If your business is using System Center Configuration Manager, it can be used to deploy and update Apps for the enterprise. 

Since no additional licensing is required for the Apps admin center, you should investigate if it can make your life as an Office 365 administrator easier. 

If you need to provide a modern printing environment for your users without having to bother with print servers or installing individual drivers for each printer on each device, consider Universal Print. 

Another way you can tell how integrated the different components of M365 are is with Search. This lets you search in various places in M365 and get relevant content for you, only showing you content you can access from within your tenant.

To properly protect your Microsoft 365 environment, use Hornetsecurity one-of-a-kind services: 

• 365 Total Protection 
• 365 Total Backup 
• 365 Permission Manager 
• 365 Total Protection Compliance & Awareness 
• 365 Total Protection Enterprise Backup 

To keep up with the latest Microsoft 365 articles and practices, visit our Hornetsecurity blog now.

At least initially, a big challenge for us in IT is the loss of control that the cloud brings. If you have a problem on-premises with email delivery, you can check every part of the chain to see where the problem lies. Once you have migrated to M365, it’s now a shared responsibility between you and Microsoft.

In this article, we’ll look at two self-help tools I use when there’s trouble and then at how you open and work a support case with Microsoft.

For email and Teams, connectivity is a common cause of issues. Microsoft offers a valuable tool: Microsoft Remote Connectivity Analyzer (MRCA or RCA) at https://testconnectivity.microsoft.com/.

Here, you can test several things: DNS entries, ActiveSync connectivity to Exchange, Outlook, and Outlook Autodiscover functionality, inbound and outbound SMTP email, etc. Pick the test you need to perform and enter the required information.

Depending on the test, you may need to enter a valid username and password – I suggest resetting the password of this account after you’ve completed the troubleshooting.

The Captcha verification lasts for 30 minutes, so if you’re doing several runs as you change values, you don’t have to verify that you’re a human every time. The comprehensive test output should help you pinpoint the issue quickly.

Suppose the issue isn’t connectivity-related; instead, you suspect a problem on a particular client device.

In that case, you should use the Support and Recovery Assistant for Office 365 (SARA) to help identify Outlook, Dynamics 365, and OneDrive for Business issues and Apps for enterprise problems.

It’s a simple download that you run on the affected device; it steps you through a few questions to track down the problem. In my experience, when you’re struggling with a profile or intermittent connection issues (that aren’t due to a service side misconfiguration – see RCA), SARA is pretty good at tracking down the cause.

Another way to help end users help themselves is the My Sign-ins, My Groups, and My Access sites, which, along with My Applications, give users a good way to manage their access to M365 services. My Sign-ins is also an excellent education tool as it lists both successful logins and failed ones from attackers.

While the benefits of cyber insurance are evident, it’s essential to acknowledge the challenges that come with it. To give some perspective: The global cyber insurance market reached $7.8 billion in 2020 and is expected to grow to $20 billion by 2025.

In recent years, the cyber insurance landscape has seen premiums rise globally by an average of 20% per year, driven by the increasing frequency and severity of cyberattacks. Insurers are also imposing higher minimum IT security requirements on policyholders. These changes can be particularly burdensome for small and medium-sized businesses.

The Health section of the admin center provides the overall health of the different services in M365, and if any outages/incidents affect your tenant, you can access the portal.

If the outage affects the portal or its health portion, try https://status.office365.com/. Also, make sure to follow @Office365Health and @MSFT365Status on Twitter.

The Health section also offers an interesting new tool called Network connectivity, which uses the OD4B client, together with the Windows Location Service and optional manual data gathering tests to identify each client’s connectivity quality to Office 365. It’s even got it its own portal.

Many businesses provide a substandard experience for their users by forcing them to use VPN connections back to the office and then onwards to Office 365 (overall a slower experience but a killer for the Team’s voice and video calls) or even proxying all outgoing traffic for “security.”

This last one is based on the erroneous assumption that all web services/internet sites are “bad” and all traffic must be inspected, rather than differentiating between business services provided by Microsoft and others that can be trusted and dodgy websites and handling the traffic accordingly.

Here’s an excellent article outlining required and optional optimization techniques for M365. Microsoft has also partnered with many ISPs, internet exchange partners (IXPs), and software-defined cloud interconnect (SDCI) providers for optimal connectivity to M365, Dynamics 365 and Azure using the Azure Peering service. Suppose your business is using a Software Defined WAN (SD-WAN).

In that case, there’s a feature called informed network routing that will further help optimize your connectivity by enabling data sharing between Microsoft and the SD-WAN provider to reroute traffic automatically where appropriate.

Today, only Cisco’s IOS XE SD-WAN is supported, but expect others to be added as the preview progresses. The new Productivity Score is designed to help you understand where your business is in its digital transformation journey and tracks metrics across two categories:

1. people experiences
2. technology experiences

PowerShell has long had a feature called Desired State Configuration (DSC) – which defines how a system (VM, Application, etc.) should look and apply the policy, and the Local Configuration Manager ensures that the system has the correct settings, checking periodically for drift.

This is called Infrastructure as Code and is now available for M365, so you could have a test tenant where you evaluate new configurations and settings, which you can then export and apply to your production tenant.

It can also be used to export all your configurations as a “backup”, periodically reporting on changes in configuration and comparing your tenant’s settings with best practices.

To properly protect your Microsoft 365 environment, use Hornetsecurity one-of-a-kind services:

• 365 Total Protection
• 365 Total Backup
• 365 Permission Manager
• 365 Total Protection Compliance & Awareness
• 365 Total Protection Enterprise Backup

To keep up with the latest Microsoft 365 articles and practices, visit our Hornetsecurity blog now.

If you’re a new business, this article doesn’t apply to you – simply create user accounts in the cloud, join your Windows 10/11 devices to Entra ID, and manage your iOS and Android devices with endpoint manager, and you’re good to go.

Most businesses, however, have investments in existing technology on-premises and need to migrate to M365. This article will cover your different options:

• Cutover migration
• Staged migration
• Express hybrid migration
• Minimal hybrid migration
• Hybrid migration
• PST-based migration
• IMAP migration
• Third-party tools

Suppose you don’t have Exchange on-premises, i.e., using Lotus Notes / Domino, another email system, Google Workspace, or another cloud email solution. In that case, you’re looking at either an IMAP migration or third-party migration services.

Most of the other migration methods rely on directory synchronization, where your on-premises AD accounts are synched to Azure AD. If you’re still on Exchange 2007, 2010, or 2013 (all no longer supported), a Staged setup allows you to migrate mailboxes in batches once you’ve configured directory synchronization.

Be aware that you must manually reconfigure each user’s Outlook profile to point to O365 when their mailbox has been migrated. For smaller environments, the Cutover approach is the easiest. Microsoft talks about this method for less than 2000 mailboxes (Exchange 2003+), but in the real world, it’s probably appropriate for 100-150 mailboxes or so, depending on internet bandwidth.

The idea is to move everyone’s mailbox from on-premises to the cloud over a weekend or other appropriate downtime. If you’re on Exchange 2010+ and plan to move all mailboxes to the cloud over a few weeks, consider the Express hybrid option. If you’re more extensive and are looking at a few months of migration time, look at the Minimal hybrid alternative.

If you have a larger environment (Exchange 2010+), you expect to be in a mixed state for an extended time, and you need the ability to move mailboxes from the cloud back to on-premises (offboarding). Consider Full Hybrid for a full breakdown of the different flavors of hybrids; see here.

The various types of hybrid provide prosperous co-existence with a unified Global Address list, sharing of Free/busy calendaring information, and seamless mailbox moves for end-users; when their mailbox has been moved, they’re just prompted to restart Outlook.

If you need to keep an Exchange server (or several) around on-premises, be aware of the need to keep it up to date so as not to be throttled, and if possible, look to retire it instead using PowerShell cmdlets to manage Exchange attributes in AD.

Microsoft’s documentation will point you to the mail migration advisor, which may lead you to the Hybrid Configuration Wizard (HCW), depending on your choices in the advisor. HCW will step you through the individual steps you must take, depending on your route, including the hybrid flavors and Staged and Cutover.

IMAP migrations let you move from non-exchange systems that support IMAP with a limit of 500,000 objects per mailbox and a maximum email size of 35 MB.

If you have PST files with email on-premises, you can migrate them to Office 365; there’s even a PST Collection tool to track them down on your network and collect them. If you have lots of them, you can even ship them to Microsoft on disk.

Once you have completed your migration, you’ll need to consider your Mail Exchanger (MX) DNS record, which will have been pointing to your on-premises mail server and now needs to be changed to Exchange Online instead.

You also need to revisit your Autodiscover DNS records, which is how Outlook and other email clients find the correct Exchange server automatically.

To properly protect your Microsoft 365 environment, use Hornetsecurity one-of-a-kind services:

• 365 Total Protection
• 365 Total Backup
• 365 Permission Manager
• 365 Total Protection Compliance & Awareness
• 365 Total Protection Enterprise Backup

To keep up with the latest Microsoft 365 articles and practices, visit our Hornetsecurity blog now.

If you’re looking for a simple mailbox migration experience, Hornetsecurity offers the Mailbox Migration Tool (MMT) as part of 365 Total Protection Enterprise / Enterprise Backup.

In this article, we will unlock the full potential of Microsoft 365 administration by exploring efficient practices through web portals, PowerShell automation, and specialized tools like Microsoft 365 Lighthouse for Managed Service Providers (MSPs).

Once you have your tenant set up in m365, you’ll need to manage it; we’ll go over the different interfaces you can use. If you don’t have an O365 / M365 tenant, sign up for a trial tenant – click try for free under E3 or E5. These trial tenants last for 30 days, although you can extend the trial for another 30 days by contacting support.

The main portal is admin.microsoft.com, which you can also reach from www.office.com by clicking on the Admin tile. On the left-hand side are links to manage Users, Groups, Billing and Settings, etc., and further down under Admin centers are links to the individual portals for Exchange, Teams, SharePoint, OneDrive, and others.

Depending on your SKU, slightly different links will show up. Highlights for day-to-day work include the ability to multi-select users (Users – Active users) and change their licensing, for instance. You can manage invited external users who have had documents shared with them from OneDrive or SharePoint, for example, under Users – Guest users. You can also restore a recently deleted (30 days or less) user.

You can manage Groups and Shared mailboxes, like “sales@mycompany.com” that is accessed by several different people and Resources such as Rooms and Equipment (booking conference rooms or company cars).

Billing is the area where you can purchase additional licenses and manage your Subscriptions and Payment methods, and Support is where you lodge service requests. Under Settings is an area where you can configure different Services and add-ins, whereas Setup lets you manage your email domains.

Reports have both Usage and Security reports, while Health has two essential areas: Service Health shows you if there are any problems in the cloud with your resources, and Message Center has a list of upcoming updates and changes. Each Admin center lets you manage a service such as Azure Active Directory or Teams.

Msportals.io has updated links for most portals, which you can access directly without going through the main portal. Note that if you’re a small business, there’s an option to have the admin center in Simplified view (instead of Dashboard view), which hides most of the complexity and provides easy access to the basic tasks of user, group, Teams, and device management.

Just click Simplified View in the top right of the Home page in the admin center.

For small tenants, you’ll probably never have to venture beyond the web portal, but if you have large amounts of users, you’re going to want to automate common tasks in PowerShell using the newer Azure AD module. To install the module in an elevated PowerShell window, simply run Install-Module -Name AzureAD. To connect (and optionally authenticate with MFA), use Connect-AzureAD.

To check that everything is working:

1. Use Get-AzureADUser, which will give you a list of the users in your tenant.
2. Refer to the full instructions, including if you need to connect to the government or Chinese / German tenants. Once you’re connected, there are many tasks that you may want to do and perhaps automate, such as managing user accounts and licensing, creating SharePoint sites and managing users and groups, configuring Exchange settings, managing email migrations, and setting Teams information.
3. Note that several of these require additional modules to be installed.

Microsoft has finally documented an official, scripted way to run a single PowerShell session connected to all the different services, whether you’re using MFA or not. For SharePoint (both Online and On-premises 2013/2016/2019) there’s an open-source alternative/complement called PnP PowerShell to the official SharePoint module by the Patterns and Practices (PnP) team.

The official SharePoint Online cmdlets are focused on creating/managing sites and users, whereas the PnP cmdlets are helpful for working with artifacts inside sites that have already been created.

If you need to manage M365 tenant settings or SharePoint Framework (SPFX) extensions, have a look at CLI for Microsoft 365, also by the PnP team, which runs on Windows, macOS, and Linux. And if you can’t be bothered to install CLI on your box, you can run it directly in Azure Cloud Shell.

If you’re a Managed Service Provider (MSP) taking care of multiple M365 tenants, you should be using Microsoft 365 Lighthouse, so do not be confused with Azure Lighthouse. Both are technologies that allow service providers to manage various tenant clients.

Still, where the Azure flavor is a way of allowing service provider users scoped access to Azure resources, M365 Lighthouse is a portal where you bring in multiple tenants and apply policies and management (including password resets for any user, in any tenant) into a single console.

To properly protect your Microsoft 365 environment, use Hornetsecurity one-of-a-kind services:

• 365 Total Protection
• 365 Total Backup
• 365 Permission Manager
• 365 Total Protection Compliance & Awareness
• 365 Total Protection Enterprise Backup

To keep up with the latest Microsoft 365 articles and practices, visit our Hornetsecurity blog now.

Master Microsoft 365 administration with web portals for user and billing management, PowerShell for automation, and Microsoft 365 Lighthouse for MSPs. Leverage PnP PowerShell for SharePoint tasks. Simplify tasks and stay informed with health checks, reports, and admin centers. Streamline your Microsoft 365 experience for optimum efficiency.

In this article, we’re going to look at the different flavors of M365, how to pick between them, and what value they provide to your business.

A correctly implemented Microsoft 365 is an enabler for your business, making it easy for your staff to work in teams and collaborate both internally and with external people in a secure manner. It also enables your employees to secure work from home/anywhere.

Apart from picking the right flavor of M365, the key to successful adoption is planning, end-user training, and ensuring your IT staff understands their new role.

Microsoft has diminished its focus on Office 365 for quite a few years now and will continue to do so. For businesses smaller than 300 staff, it’s no longer an option, and for larger businesses, the recommendation is to look at Microsoft 365 plans (see below).

We’ll use the term SKU; it stands for Stock Keeping Unit and is a term that describes different licensing levels. Your first decision here is between Business and Enterprise SKUs. The former tops out at 300 users, so if you have a more significant business (or are expecting to grow), stick with the Enterprise flavors.

To clarify – Microsoft 365 Apps for Enterprise (what used to be called Office ProPlus) is the new name for desktop applications such as Word, Excel, etc., available for Windows and Mac – some SKUs include it, and some don’t.

On the other hand, all plans include Office Online (renamed just “Office” – not confusing at all), so Word, PowerPoint, etc., are running in a browser. Note that these online versions of Office are limited in functionality compared to their desktop brethren but are helpful for quick edits.

On the Enterprise side (which is only a name; it doesn’t have to be for a considerable business; for example, you could have five lawyers handling susceptible data in an SMB using Enterprise E5), there are Apps for enterprise that only give you Apps for enterprise and OneDrive file storage but no other cloud services.

E1 gives your Office (Online) and Exchange, OneDrive, SharePoint, Teams, Yammer, and Stream; E3 gives you Microsoft 365 Apps for enterprise in addition to E1’s cloud services, and E5 adds PowerBI as a cloud service, along with several security features.

Have a look at the official comparison, which clearly illustrates the differences between these plans.

Microsoft 365 and Office 365 Plan Options cover all the plans, including tailored versions for Education, Government, and country-specific flavors for China and Germany.

The most crucial point is that the different SKUs within each family aren’t mutually exclusive. In a small manufacturing business, you may have factory workers on Business Essentials, the office staff on Business, and the executives on Business Premium, and in a more significant business, users could be spread across E1, E3, and E5 licenses.

The Microsoft 365 and Office 365 platform service descriptions cover the platforms’ offerings in minute detail.

Building on top of the O365 plans above, M365 adds Windows 10 Enterprise, Endpoint Manager (Intune), and Azure Active Directory Premium.

For Business (up to 300 users), there are three options: M365 Business Basic, which gives you Office (online only), email, file sharing, Teams, and security features.

M365 Business Standard adds the desktop version of Office, “Microsoft 365 Apps for Business”, whereas M365 Business Premium adds iOS, Android, and Windows 10/11 device management and policy enforcement from Intune plus many advanced security features. See more here.

On the Enterprise side, there’s F3 (for “Frontline” workers, used to be called F1), which gives you Office (Online), Windows 10 Enterprise, Active Directory Premium P1, Azure Information Protection P1, and Intune on top of O365 E1.

E3 adds Active Directory Premium P1, Advanced Threat Analytics (ATA), Azure Information Protection P1, Windows 10 Enterprise, and Intune on top of O365 E3. Finally, E5 adds Active Directory Premium P2, Microsoft 365 Defender, Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity and Azure Information Protection P2, Windows 10 Enterprise, a host of security features and Intune on top of O365 E5.

It’s tempting to think, “I’m a small business, so I can save a few dollars with Business SKUs”, but you need to be aware of some limitations. Your OneDrive for Business is limited to 1TB per user in Business, whereas in Enterprise you can increase this with a support call.

Microsoft has made substantial changes to the Business Premium plan. It now includes all the features of Azure AD Premium Plan 1, so in addition to the security features already included (Conditional Access, self-service password reset, and MFA), this adds cloud app discovery, Azure AD Application Proxy, dynamic groups, and passwordless authentication.

There are a lot of valuable security features in the Enterprise plans, mainly M365 E5.

Be aware that you can move licenses between different SKUs (upgrade and downgrade) and upgrade Business SKUs to Enterprise SKUs.

This discussion has been around the total SKUs and what features they contain, but it’s also possible to purchase individual features such as just Azure Active Directory Premium P1 as a stand-alone feature, for instance. Depending on the needs of (some) of the users in your business, you can tailor an exact package with just the features they need.

A great way to understand all the different parts of M365, how they fit together, and a quick description of each service is the periodic table of Microsoft 365.

To properly protect your Microsoft 365 environment, use Hornetsecurity one-of-a-kind services:

• 365 Total Protection
• 365 Total Backup
• 365 Permission Manager
• 365 Total Protection Compliance & Awareness
• 365 Total Protection Enterprise Backup

To keep up with the latest Microsoft 365 articles and practices, visit our Hornetsecurity blog now.

The main takeaway from this article is not to assume that if you’re a small business, you should automatically opt for a Business SKU, investigate exactly what features will serve your business needs, and don’t be afraid to mix different SKUs for different worker roles.