Office 365 Configuration Completion Checklist

Office 365 Security Configuration Completion Checklist

This will give you a good baseline and a secure organization. Once you have done this, the next step is to take a new baseline secure score. This will be your baseline token used to compare the organization. This is your configuration that will be used for success measurements. In our case, we started with a score of 31 and ended with a security score of 136 (see Figure 8-8). Our additional changes has raised this score to 412 - an increase of 381!

Administrator Roles

There are different permission structures in Office 365, depending on which console you are given permissions to use. The basic administrator permissions of Office 365 are shown in Figure 8-14. There are five different administrator permissions that may be assigned to user accounts on Office 365. The only account that is assigned global permissions by default is the first account. This account was created when you purchased the service. All other accounts are assigned user-level permissions. Depending on the size of the organization, it may make sense to assign different roles for different job functions.

Microsoft’s approach is to provide administration management like on-premise Active Directory. Active Directory Synchronization (using AD Connect) used to “sync” the AD environment to Office 365. The Office 365 (and Azure) permissions are global in design, and the individual admin centers are used to restrict permissions. For example, global administrators have all rights, but to access eDiscovery data, the data needs to be placed in the appropriate Exchange administration permission groups. Smaller companies do not need to have such distributed administration rights and tend to be less granular. Small organizations typically assign three roles: Global administrator, Billing administrator, and Password administrator. There are additional permissions that are assigned based on the additional subscription offerings (see Figure 8-15).

In Figure 8-15, the additional license roles are for Skye for Business, Dynamics 365, and Power BI. In addition to the license roles, there are roles that are granted for the Microsoft Direct and Indirect Cloud solution partners. These additional roles are granted by customers to help manage the Office 365 offering they have purchased from Microsoft.

Step back and look at your company and the different roles you can assign to personnel in your company. Microsoft’s security model is to assign the least role possible and to grant basic permissions that are required to complete the job. When you assign roles, verify that you are providing access at the appropriate level needed to execute the administrative task. Table 8-4 has detailed descriptions of the different administrator rights.

The typical Office 365 configuration leaves one account (usually the root account—the initial Office 365 account) as a global admin user without any user licenses. Some organizations leave this as a global admin account, and others use it as a user account. Regardless of what you do, the first account is the root account. The root account should never be used as a user account. The root account in Office 365 is the base account that is used to create all the different services that are linked to the Office 365 tenant. As Microsoft has deployed new versions of Office 365, the dependence of the root account has been minimized. We recommend that you do not delete or assign a user to this account.

In the past, the first account was a sacred account, and many Office 365 services depended on this account. Microsoft addressed the dependency of the first account by creating a new internal Office 365 group known as the company administrators . All global admins are members of the company administrator group. This group is where the base permissions are assigned in Office 365. This internal account reduces the criticality of using the root account as a user account.

Our objective is to provide you an overview of the key areas you need to cover on Office 365 as an administrator. To understand the administrator functions better, you need a roadmap as to what to look for.

Config: Overview

The Office 365 admin center (see Figure 8-16) is extremely flexible for managing your Office 365 organization. Our first step to managing Office 365 is to make sure you have the correct administrative roles assigned to your IT support staff. The next step is the configuration of the 365 tenant. The basic Office 365 admin center allows you to manage users, groups, support, settings, setup/domains, reports, and health. The additional admin centers are used to manage the unique features to each of your subscription. As an example, if you only purchase Exchange plan 1 (and not other features), then the admin center will only have Exchange and Security & Compliance Center as options.

In previous chapters, we reviewed the Security & Compliance, Azure AD, and EMS/Intune. This chapter, besides covering the Office 365 administration, will also review Exchange, Skype for Business, SharePoint, and OneDrive from an administrator perspective. There may be additional admin centers listed in your Office 365 tenant. These centers appear based on the active license assigned to the Office 365 tenant.

The configuration sections that follow are organized based on the required configuration order. As an example, to configure users, you need to configure your Office 365 domain and have the appropriate licenses assigned to your tenant. If you have this already configured in your Office 365 account, then use this section to review what you have set up. In our case, when I wrote this chapter, I discovered that the Office 365 domain structure changed, and even though my Office 365 was functioning, the features were having weird hiccups that no one could explain. I discovered that the DNS setup I had was no longer valid and needed to be updated.

Config: Domains

There are no practical limits on the number of domains that can be verified on Office 365. The rules are simple: you need to verify a domain if you want to use the domain in Office 365. Once you verify the domain, you assign the domain different use rights, depending on the licenses that were purchased for your Office 365 service.

The migration to Office 365 was covered in Chapter 7. In the previous steps, if you have already cut over to Office 365 or added another domain to Office 365 (the focus of this chapter), then change the MX, SPF, and Autodiscover records.

After you select “Add a domain,” enter the records in Office 365 and validate the domain. If the record cannot be validated or is in use by another Office 365 tenant, the domain validation wizard will allow you to send an email transfer request to the owner of the domain you are trying to validate. You can only have one Office 365 tenant per domain.

We started the process of adding the domain to Office 365 (see Figure 8-18). The first step was to verify the domain with the TXT records. Once the DNS verification records was added, we used the Domain wizard to add/validate the complete. When you have successfully added the records, you should see a summary page (see Figure 8-19). If you have errors, the Domain wizard will display the errors so you can resolve them.

Config: Domain: Troubleshooting

Once you have added the domain, Office 365 constantly verifies your DNS and highlights the invalid DNS records. Fixing the records is easy: just select the domain (see Figure 8-20) and then select Check DNS. If there are any issues present or a configuration that you can’t use, Fix Issues is available as an option. Correct these records in your DNS records and verify them until all the records have no errors.

Config: Adding/Changing and Decreasing Licenses

There are multiple ways that you can change license numbers in Office 365. Microsoft allows you to change the existing license quantity, add new licenses by purchasing URLs, purchase a volume license key, or purchase licenses from your Microsoft Partner. The question for most users is where to find the simple display that summarizes the license mix. To find out the license mix, select the Products sidebar menu option (from the grid, select Admin ➤ Admin Center ➤ Setup ➤ Products).

You can manage the licenses from the setup portal. What Office 365 does is link the portal into some of the other portals (see Figure 8-21). For instance, the assign function links this to the user assignment. Likewise, the purchase option links you into the subscription adjustments.

If you are using a CSP, you will need to contact your CSP partner or use your partner’s configuration portal to adjust the licenses. KAMIND IT’s license portal is at www.kamind.com/license and requires an Office 365 account to log in. KAMIND IT offers this service at no charge for the license management of Office 365 subscriptions.

Reducing licenses is simple in the administration portal (see Figure 8-22); just select the Subscription sidebar menu option (from the grid, select Admin ➤ Admin center ➤ Billing ➤ Subscription) and the subscription that needs the license quantity adjusted. You can reach this same menu from the Products menu.

You can also increase the number of licenses through the same process (described earlier), or you can purchase a volume license key from a reseller. These volume license keys are called open license keys. The process of adding licenses is slightly different when you use a reseller to purchase the license. Figure 8-23 shows you the different ways you can activate an open license key from your Microsoft Partner. Open licenses are different than a license from a CSP partner. If licenses were supplied by a CSP partner, these license adjustments will automatically appear in your account.

When you purchase an open license from a partner, you retrieve the subscription license number from the volume license center ( www.microsoft.com/licensing ) and select the appropriate link to start the activation process (see Figure 8-24). You must be a global administrator to add the open license key to your Office 365 environment.

Log in to the Office 365 tenant and follow the wizard to add the new subscription to your environment. If you purchase multiple licenses of the same license type (an E3 Open subscription), all the licenses are pulled together as one license group. It works better if you add each license one at a time to get the correct expiration dates. In Figure 8-25, we are adding 25 licenses. If there were multiple licenses added on the same date, Microsoft gives you the option to group the licenses together for a common renewal date.

Once you have added the licenses to your Office 365 subscription, the new licenses are updated in your subscription portal. We recommend you always add the licenses before you add users.

Config: Password Expiration

Office 365 allows you to configure a password policy to allow password changes between 14 and 730 days (see Figure 8-26). Typically, a password policy is set to 90-day expiration and with a 14-day warning. To change the password policy, select Security (from the grid, select Admin ➤ Admin center ➤ Settings ➤ Security) and change the parameters for your password reset. In the security area, you also have the master control to turn on/off sharing for the Office 365 tenant.

Once you have edited the password option, set the password policy for your organization. We recommend you leave the default (change passwords every 90 days), unless you are planning to enable multifactor authentication. Changing the password is simple: select the new password option and click Save after you make the changes (see Figure 8-27). These changes are global and affect all users.

Config: Completing Company Configuration

When Microsoft releases a new feature, these features are optional for the organization. To enable the feature, you must actively turn the feature on for deployment. A good example is Microsoft Teams. This is like the third-party product Slack, but Teams is included in your Office 365 subscription. To access Teams, select Admin ➤ Admin Center ➤ Teams & Skype (see Figure 8-29)

.

Config: Partner Administrators

“Partner relationships” is where you add a partner as a delegated administrator. These are your trusted advisors. There are two types of delegated administrators: Microsoft and Microsoft Partners. When an Office 365 site is created, no administration rights are granted to any external parties. Microsoft does not have the ability to access user data, unless that right is granted by the account owner. There are two types of partner administrators: delegated administration from a Microsoft cloud advisor and a Microsoft CSP (see Figure 8-30).

CSPs are different from CSAs. For example, KAMIND IT CSP offerings are listed at www.kamind.com/csp . Keep in mind that if you purchase licenses through a CSP, your Microsoft account is managed by the CSP, not Microsoft. If you remove a partner CSP access, you may have breached your agreement with Microsoft.

Config: Adding, Deleting, and Restoring Users

Office 365 supports many features that you can configure through the Office 365 user interface. Some actions (such as setting conference room permissions) are available only using PowerShell. If you are running Active Directory Synchronization (AD Connect), you can use your on-premises Exchange Server 2010/2013/2016/2019 or Active Directory tools to configure services (and sync those changes into the cloud). Our focus in this chapter is on the user configuration of Office 365 using the Office 365 interface.

If you need to assign user passwords, you need to use the PowerShell commands. Typically, we load the users using the bulk-load options, and then we assign the passwords using PowerShell. If you have an Active Director Connector (AD Connect) running in your on-premises environment, you need to assign passwords using the on-premises Active Directory tools.

Users: Adding Office 365 Users via the Office 365 Admin Center

The Office 365 user administration tool can add users only at the Office 365 level. If you have a connected on-premise environment and those users access on-premise resources, you must add the users using the on-premise Active Directory administration tools. The Active Directory Connector enables only specific Active Directory objects to be used in the cloud and is a one-way activity.

Log in as an administrator (at https://portal.office.com or http://portal.microsoft.com ), as shown in Figure 8-31. Click the nine-block grid (at the top left). Next, click Admin ➤ Admin center ➤ Users ➤ Active users. Click “+ Add users” to add a new user.

Fill in the information for the user and create the account. The minimum information you need to create a user is the username (first, last), e-mail address, and licenses. There are additional configuration options on user accounts (contacts, password, products, and administration roles) that may be needed. These additional fields are optional. There are four steps to set up a user account.

1. 1.

   Set up the user name and primary e-mail address.

    
2. 2.

   Set the user password.

    
3. 3.

   Set the user administration permission (no administrator rights are the default).

    
4. 4.

   Assign a license.

    

These steps are reviewed next.

Step 1: Add User Information and E-mail Address

See Figure 8-32.

Step 2: Add Password Information

It is important that you change the default password policy when you create a new user. There are cases where you need to set the password when the account is created and cases where you need to have the user reset the password. Our recommendation is that you always have the user set their own password (see Figure 8-33).

Step 3: Assign Administration Roles

When you add a user, you can assign the role for the user (see Figure 8-34). Only global administrators can assign administrator roles. If you assign a user admin rights, you need to supply a mobile phone number in the contacts and an alternate e-mail address (not located in your current Office 365 tenant); otherwise, you cannot create a new account. All administrator users must have a cell phone that receives calls.

Step 4: Assign the Licenses to the User

You can assign any valid license to the user. You can also selectivity assign access to the various Office 365 services (see Figure 8-35). Office 365 allows you to enable/disable different services associated with the license. Some organizations do not want to allow users to access services that the help desk cannot support. The global administrators can enable or disable the service on each user account or using PowerShell. Once you have selected the appropriate licenses and other license features, click Save. You have created the user account.

In this example, we assigned E5 licenses with the Enterprise Mobility Suite (EMS) and Skype for Business. As an administrator, you can selectively remove access to different licenses. To remove capabilities, just move the option switch to Off.

Users: Changing User Information

You can also change any information about a user. Just select the user and edit the information (see Figure 8-36).

Users: Deleting

Deleting users is as simple as selecting the user and then selecting Delete (see Figure 8-37). If the “delete user” trashcan icon is not present, then the user is blocked from deletion in Office 365, and you need to use the PowerShell command to remove the user account. A blocked user account usually happens when a user is placed on legal hold or when an account was not deleted properly. To remove users that are on litigation hold, you need to remove the in-place hold or the legacy litigation using PowerShell or the Exchange admin center. Once the in-place or litigation hold is cleaned up, you can delete the user. When you delete an account, we recommend you follow these steps:

1. 1.

   Remove any legal hold on the account.

    
2. 2.

   Disable the archive on the account (if enabled).

    
3. 3.

   Remove any e-mail alias assigned to the account (leave only the onmicrosoft.com name and SIP).

    
4. 4.

   Set the user account to the onmicrosoft.com name as the primary address.

    
5. 5.

   If you do not want to keep e-mail (or move e-mail to another account), then remove all licenses from the account.

    
6. 6.

   Delete the account. (If you delete the account, the mail will be deleted!)

    

Note

Before you remove the user account (as suggested earlier), verify that you have the OneDrive for Business data backed up. Removing the e-mail address may delete the user’s OneDrive for Business data. Deleted account data will be retained for 30 days after the account has been deleted or licenses has been removed.

Deleted users can be recovered up to 30 days and are in the Deleted Users folder. If you want to remove the user from the Office 365 Deleted Users folder, run the following PowerShell command to purge the user account. If you have not set up PowerShell, see the “PowerShell” section later in this chapter. These PowerShell examples are code snippets and require the necessary credentials to execute.

PowerShell provides commands to return the list of deleted Office 365 users. This PowerShell command returns all the deleted user accounts in the recycle bin with the GUID for the user.

Get-MsolUser –ReturnDeletedUsers

Here are the PowerShell commands to remove the user account from the Deleted Users folder using the user e-mail address:

Remove-MsolUser -User <such as [email protected]> –RemoveFromRecycleBin

Users: Restoring

To restore deleted users, select “Users and groups” and then “Deleted users.” You can then select the user account you want to restore. Deleted users remain in your Office 365 Deleted Users recycle bin for 30 days, depending on the configuration of Office 365. Figure 8-38 shows the deleted users restoration option. Just select the user and then click Restore. You can only restore users to the same license provisioned to the user account when the account was deleted.

After you select the user to restore, Office 365 will confirm the restoration and allow you to set the password as well as decide whether the user should reset the password on login to the Office 365 services.

Note

If you attempt to restore a user and it fails because of the account being managed by a different service, use the RestoreMsolUser PowerShell command to restore the user account.

Users: Renaming

Renaming a user display name is a simple process: select the user account from the Office 365 admin center, followed by Actions, and then the property you want to change (see Figure 8-39).

After you select the user, select the edit function for the area that you want to change. For example, you can select the user name/e-mail address and change the username, add an e-mail alias, and set the domain as the primary login address (see Figure 8-40) of the user.

Config: Groups (Office 365 and Security Groups)

Groups are used to manage permissions globally in Office 365. There are different ways to use security groups. You can use security groups to filter users and administrator permissions (useful in large organizations). You can also use security groups to manage permissions for different services. SharePoint (as an example) can use security groups to grant permissions to various site libraries for users. You can also use SharePoint security permissions to restrict access to different libraries in SharePoint. For example, in large organizations, you can create a security group to isolate users from each other and use security groups to manage access to different federated services (such as Intune and Azure services). There are different ways to use security groups, depending on your business needs. Some organizations use security groups to manage SharePoint services. For example, a SharePoint site is designed and security groups are created to assign permissions to different areas. The global administrator adds accounts to the different security groups, depending on the business requirements. The users added to the security groups inherit the permissions necessary to access the functional areas in SharePoint.

Creating security groups is easy. Sign in as an administrator, and select Groups (select grid, then Admin ➤ Admin Center ➤ Groups ➤ Groups). Click the + to add a new Office 365 group or a security group (see Figure 8-41).

If you’re looking to create a different type of group (other than a distribution group), select the type of group from the drop-down (see Figure 8-42) and then follow the same steps for creating a new group.

Config: External Sharing

The administrator uses external sharing to manage external access to manage Office 365. Office 365 is designed for collaboration. As an administrator, you control how SharePoint (aka sites), calendars, and teams are shared. There are two steps to manage collaboration: enabling the service for external users (set the capability on or off) and configuring the local services (SharePoint, Skype for Business account) in the various admin centers. If you disable the global options, then the local service options will not have those external feature options. You should configure the services, as shown in Figure 8-43, for external sharing.

Config: External Sharing, Sites

If you select “Site settings,” this will give you the necessary controls to manage external sharing for the SharePoint Office 365 SharePoint services and OneDrive for Business. The “sites” sharing controls are used to enable these services for external access. As an administrator, you can choose to define how you externally share. In Figure 8-44, you can see three different models for sharing Office 365 content.

Note

Authentication requires that you have an Office 365 Work account or a Microsoft account. A Microsoft account can be any e-mail address. When you create a Microsoft account, you are adding additional security credentials to your e-mail address. To create a Microsoft account, go to http://account.live.com .

Once you have set up global sharing, then the next step is to configure the individual sites (see Figure 8-45). Go to the SharePoint admin center (select Grid and then Admin ➤ Admin Center ➤ Admin Centers ➤ SharePoint). When you create a new SharePoint Site, the default sharing is off, and you need to enable sharing. To enable sharing, select the “site” in sharing, then click the Sharing icon, and then define how you want to share the site. If you want to control the OneDrive for Business sharing, select the site that has -my. This is https://kamindsecure-my.sharepoint.com (also known as the OneDrive for Business sites).

This is how an administrator manages the external access to different sites. Administrators have the permission to set the allowed sharing (with logins, without logins, or disabled altogether). Administrators also can manage the external users that have shared documents (see Figure 8-46).

Config: External Sharing, Calendar

Administrators can also control the way calendars are shared. For example, you may want to openly share information with external users to see the details in your calendar when you get a meeting invite. Likewise, you may want to restrict the information to free/busy. The settings in Figure 8-47 apply to all users globally, regardless of their individual settings.

Config: External Sharing, Teams

Teams is the business version of Skype. Business users can communicate to other business users by using an e-mail address, if the sharing is enabled in the Office 365 account. Skype users can communicate to Teams users only if the administrator has allowed this option. In both cases, you need to have the e-mail address of the user to speak with them. To set up Teams sharing, go to the Teams admin center (select Grid, then Admin ➤ Admin Center ➤ Admin Centers (at bottom) ➤ Teams & Skype for Business) If you purchased the Teams calling plans, we’ll walk you through the configuration steps later in the chapter. The basic sharing configuration (allowing you to speak with other Teams users and Skype users) are controlled, as shown in Figure 8-48.

Teams: Federation

Skye for Business is configured to communicate to external users. To verify the configuration for Skype for Business, select the Teams admin center from the Office 365 dashboard (under the Admin tab) and then select “organization” and “external communications” (see Figure 8-56). Teams federation is enabled, and if the service is not configured within a 12-hour period, submit a service request to Microsoft Online Services. Once the Teams service is provisioned, you are enabled for external communications.

Teams: Voice

Teams supports domestic and international voice. The configuration requires that that you have properly set up and verified the DNS. Teams allows you to port numbers to the service or to generate the necessary numbers for your users (see Figure 8-57). The Teams voice management is in the legacy Skype for Business administration center.

The configuration requires that you have properly set up and verified the DNS. There are two phases to configure Office 365 Teams voice. First, add the phone numbers and assign them to users.

Step 1: Add Phone Numbers

Adding phone numbers is a straightforward process. Select the “phone numbers” option, followed by +, and then add the new numbers (see Figure 8-58).

The Teams phones are grouped into two different types: user numbers and service numbers. Select the type of voice link that you need to use for the Office 365 services. You can check your location to see whether a phone number is available (see Figure 8-59). Enter the desired number of phone numbers. Teams will attempt to acquire the phone number that you need.

The phone numbers are available for only a few minutes. The phone number request is from the telephony service provider. If you do not select the phone numbers, they will be returned to Microsoft for allocation to other users.

Note

Teams voice is a new service. Like any VoIP service, it is best to configure the service to meet the business needs (use the number provided). Once you are ready to transition to the new service, then port the phone numbers. Number porting is not instantaneous.

Step 2: Add an Emergency Response Location

Once you have your phone number, you can set an emergency response location (see Figure 8-60).

Step 3: Add Phone Numbers

Once you have your emergency response location set up, the next step is to assign the phone number to the different user accounts. Select the user account (see Figure 8-61) and assign (or remove) one of the phone numbers you allocated from the previous step.

Once you assign the phone number to the user, you have completed the configuration of the Teams voice system. The Save button is enabled if the emergency location has been identified (see Figure 8-62).

Step 4: Verify That Voice Has Been Provisioned

Have your user log out of Teams and then log back in. The “dial paid” will show up once the user logs back in to the service (see Figure 8-63).

At this point, you are ready to use the service. There are additional configurations of voice systems that you may want to have the user complete. For example, we let our desk (Skype for Business) and our smartphones ring at the same time. To access the ring options, select Tools ➤ Options (under the gear; see Figure 8-64) and then adjust the time length for the phone to ring.

We have found that setting the phone number to ring for 35 seconds is about the right amount of time to have the phone ring on our cell phone (and be able to answer the call). You set this option under “Call forwarding” in your Teams client.

Note

Make sure that you test the ring delay for voicemail. The default setting, 20 seconds, is too short to ring to a third number; 35 seconds is a better ring delay to launch Teams on your cell phone and to answer the call (see Figure 8-65).

Skype for Business: Conferencing Add-on

There are several different conferencing suppliers for Skype for Business. To find all the providers, in the Teams admin center, select the “dial-in conferencing” tab (see Figure 8-66). You can use Microsoft or a third-party supplier (such as InterCall). Configuration of the service is simple: you need to assign a Teams conferencing license to the user and then enable the service. There is nothing else that you need to do. Microsoft service numbers are integrated with the licenses.

If you are using a third-party provider, enter the dial-in information for the user account under “dial-in users.” Your teleconferencing bridge number is enabled and automatically generated with an Outlook calendar invite if Teams is installed and running on your desktop.

Exchange Administration Roles

In larger organizations, different roles are assigned in Exchange. But in small organizations, there are only two roles that are commonly used: the company administrator role (global admin via the AdminAgents role) and the discovery management role. The global admin does not have access to discovery management unless that role is granted and permission is granted in the discovery SharePoint center.

You can assign any of the administrator roles in Table 8-4 to the user mailbox. Our recommendation for assigning user permissions follows this model:

1. 1.

   Build a security group for the accounts that will be managed. The user who will manage these accounts should be in the security group.

    
2. 2.

   Assign the user Exchange administration permission to the selected account in the newly created security group (see Figure 8-69).

    

Once you have assigned permission to the user to manage Exchange users, you can create the necessary user roles (if needed) to manage the group.

Default User Role Defined

Either create a new role or modify the existing role, and change the permissions associated with the role. If you modify the default role, you change the role for all users. It is recommended that you create a new role and then apply that role to the user account (or accounts). To create a new role, select Permission ➤ admin roles. Either create a new role (click the +) or modify the existing role (click the pencil icon), as shown in Figure 8-70.

Exchange: Conference Room, Configuration

Office 365 provides a resource called meeting room. Meeting rooms are used to control resources that are limited and need to be managed through scheduling. To set up a meeting resource, log in to Office 365 as an administrator and select Admin center ➤ Exchange ➤ Exchange admin center (EAC).

Creating a conference room is simple. After you have selected the EAC, select recipients ➤ mailboxes (in the drop-down dialog box in Figure 8-71), and select “Room mailbox.” This sets up the meeting room with a default configuration (if the meeting room is being used, it shows a busy status). There are additional configuration changes that can be made on conference rooms, but there is no GUI interface. These changes would need to be made using PowerShell.

When you create the meeting room, the first order of business is to assign users that have permission to book the meeting room. These users are called delegate users . You have two options on meeting rooms: allow all users to book meeting rooms (default) or allow restricted users to book meeting rooms. Provide the name of the meeting room and select the appropriate option; then click OK (see Figure 8-72).

The room is configured with the default setting showing only a busy status. Meeting rooms are versatile. You can use this function to reserve any type of resource, such as equipment. Remember, meeting rooms are a single device, and a meeting room resource manages multiple objects. To use meeting rooms to manage multiple objects, you need to create a meeting room for each device. After you have created the room, you can modify the capabilities of the room based on your needs from the Exchange admin center or from the Office 365 admin center (see Figure 8-73).

Exchange: Conference Room, PowerShell Modification

Conference and resource rooms provide the basic configuration for use, but there are additional configuration options that can be done only using PowerShell. For example, the default configuration hides the meeting status and ownership. If you want to make those available, you need to run the following PowerShell commands.

Set limited details of a conference room using PowerShell:

Exchange: Adding an Alias E-mail Address to a User

It is simple to add an alias e-mail address. Earlier we added the e-mail alias for the main Office 365 admin center. In this case, we are adding the alias from the Exchange admin center. To add an alias, select the user account, click Edit, and select the e-mail address (see Figure 8-74). Enter the new e-mail “alias” address for the user. The domain must be verified in Office 365; otherwise, the alias will not be added.

Exchange: Changing a User E-mail Account Primary Domain

Office 365 supports multiple domains and multiple user e-mail aliases per an account. In some cases, an Office 365 organization may need to change to a new domain (e.g., after a company merger or branding change). Making the change for all users is not difficult: all that is required is to verify the domain (set the MX records and Teams records), add the domain to the existing users, and set the reply address to the new e-mail alias. What you cannot do is change the <domain>.onmicrosoft.com account. If you need to change the <domain>.onmicrosoft.com, you must migrate to a new Office 365 organization.

Exchange: Adding Shared Mailbox

The key decision factor for most users is to receive the information on smartphones. This requirement dictates that you use an Office license rather than a free, shared mailbox.

Exchange: Shared Mailbox, Using with a Smartphone and Outlook

Smartphone devices require an active sync connection. You add a shared mailbox the same way you add a mailbox to Office 365. The only issue is that you must assign delegated rights to the users who want to use the mailbox. This is the same for all user mailboxes. Once a mailbox has been created, you need to assign share rights to the mailbox.

To add a shared mailbox, follow these steps:

1. 1.

   Purchase an Exchange Plan 1 (or Plan 2) mailbox.

    
2. 2.

   Assign a user account to the Exchange e-mail account.

    
3. 3.

   Assign user-delegated rights to the mailbox.

    

In the Exchange admin center, highlight the user account, click Edit (the pencil icon), and then select the e-mail address (see Figure 8-75). Select “mailbox delegation” and then add the user for both Full Access and Send on Behalf. Click OK when done. The mailbox is modified.

Exchange: Shared Mailbox, Using Only with Outlook

If you need to add a shared mailbox for use only with Outlook (and you do not want to use a license), you can create a shared mailbox in the Exchange admin center and then add the user as a delegated user to the mailbox.

In the Exchange admin center, click Shared. Create a shared mailbox. In this case, we created a mailbox called CompanyCal (see Figure 8-76). Select the mailbox and then “mailbox delegation.” Add the users who will access the shared mailbox. Click OK when completed. The shared mailbox will appear in Outlook for each user added as a delegated user.

Exchange: Adding a Distribution Group

There are three different types of distribution groups: distribution groups, mail-enabled security groups, and dynamic distribution groups. When you add a group (see Figure 8-77), you select a group based on the business role that you want the group to perform.

Step 1: Create the Distribution Group

In the Exchange admin center, select “recipients” and “groups” (see Figure 8-78). Verify that the distribution group is being created; otherwise, an Office 365 group is created. Add the group by clicking the + and then select the distribution group to be added.

Step 2: Define the Distribution Group

Fill in the information about the distribution group. When you first create the group, leave the defaults in place. You must specify an owner of the group and any initial members you want to add (see Figure 8-79).

Step 3: Enable the Group for External Access

After you have created the group and saved it, the group is set up for internal access. If you want to enable the group for external access, you must edit the group and enable the external access options (see Figure 8-80). Select the group, click Edit, and then select the “delivery management” option. This is a two-step process. You must create an internal distribution group (and save it) before you can enable it for external access.

Exchange: Using Alias to Send to/Receive from E-mail

You may want to use a different e-mail address to send and receive e-mail. Office 365 is designed to allow only one e-mail address to be used: your primary e-mail address. The way to work around this is to use a distribution list and to grant a user account full permission to use that distribution list with PowerShell. Log in to the Office 365 admin center, and on the Admin tab, select Exchange and follow the steps outlined next.

Step 2: Configure the Group Being Added

Since this is a personal alias, add a description and complete the additional steps for the configuration of the group (see Figure 8-81).

Add the user and select the membership options. Since this is an e-mail alias (i.e., an internal group), it is recommended that you restrict it to the individual who is using the group (see Figure 8-82).

Step 3: Enable the Group for External Access

In the Exchange admin center, select “groups” and then click the pencil icon to edit. Select “delivery management” (see Figure 8-83) and then enable the mail option (“Only senders inside my organization” is the default) and the user for access outside the organization. This is identical to the external distribution groups discussed earlier.

Step 4: Grant Permission to the User

The final step is to grant permission to the user. There are two ways to do this: either through PowerShell or by using the Exchange admin center. In the Exchange admin center, select “groups,” and then click the pencil icon to edit. Select “group delegation.” You need to enter the user account for both Send as and Send on Behalf (see Figure 8-84). Click OK. The user is now able to use the From address in Outlook, or in the Outlook Web App, to send e-mails using the alias e-mail address.

You can also grant permissions using the PowerShell commands for a shared mailbox. In this case, you are using a distribution list and granting full access for its use. Execute the PowerShell command and give access rights to the user mailbox. The shared mailbox PowerShell command is as follows:

Add-RecipientPermission -Identity [email protected] -Trustee [email protected] -AccessRights SendAs

Step 5: Verify Outlook Configuration

The final step is to send an e-mail from Outlook to verify that you can send a message from an alias (see Figure 8-85). For this to work, you must select the e-mail distribution group you created earlier. In our example, we used Get365. Select Get365 from the group e-mail address book. (If you manually type the e-mail address in, this will fail.) To send an e-mail alias from Outlook, follow these steps:

1. 1.

   Open Outlook and select From ➤ Other e-mail address (see Figure 8-84).

    
2. 2.

   In the From box, select From and find the distribution alias (see Figure 8-85).

    
3. 3.

   Click OK to send the e-mail.

    

After selecting “Other E-mail addresses,” select the distribution group (see Figure 8-86). You cannot enter the distribution group name in the address bar. The e-mail will not be sent.

PowerShell: Setting Up Teams and SharePoint

These additional commands are described in the following sections. Before you can use the commands, you must download and install the PowerShell extensions.

PowerShell: Using the Standard Header for Microsoft Online Services and Exchange

PowerShell can be complex for any user. When using PowerShell with Office 365 and Exchange, you need to use a standard PowerShell header. This standard header allows you to connect directly to the Office 365 administration interface and make the necessary changes. However, if you do not set up the commands correctly with the remote interface execution parameters, the PowerShell command will fail. The only issue is that the user account that you log in to (for Office 365) must have a license assigned to it. The licensed user can only execute the PowerShell commands for Office 365 that the user admin account is licensed to use; otherwise, it will fail.

Once you have verified the functionality of the header script, you are ready to make the necessary changes in Office 365. This section of the administration maintenance manual lists the type of problems encountered and the PowerShell solution. All that is needed for the user to execute these commands is to use an account—with global administrator rights—that is licensed with an appropriate subscription (such as Exchange, SharePoint, etc.).

Troubleshooting: Autodiscover

Autodiscover allows an Outlook client (including your laptop and your smartphone) to discover the location of the Office 365 Exchange e-mail server and to automatically connect to that server (see Figure 8-90). You need to insert the Autodiscover record in the external DNS and the internal DNS. Both records should point to outlook.com .

The Autodiscover process is outlined in Figure 8-91. When an internal client looks up an Autodiscover record, it first determines the Autodiscover record through Active Directory. If the client is external, it looks up the Autodiscover record from the DNS.