To view account license and service details

First, connect to Microsoft Graph.

Connect-Graph

To list all license plans you purchased with part number and ID,

Get-MgSubscribedSku | Select-Object SkuPartNumber, SkuID

To list the services that are available in each license plan,

$allSKUs = Get-MgSubscribedSku
$allSKUs | ForEach-Object {
  "Service Plan: " + $_.SkuPartNumber
  $_.ServicePlans | Select-Object ServicePlanName, ServicePlanID
}

To list all license plans assigned to a specific user,

Get-MgUserLicenseDetail -UserID $userID

To list all services from all assigned license plans for a specific user,

(Get-MgUserLicenseDetail -UserID $userID -Property ServicePlans).ServicePlans

Service plans can be quite messy if you manage them manually so using PowerShell could save a lot of time and could make things a lot easier.

To assign or remove a license plan from a user account

Now you need to sign in to Microsoft Graph with some extra permission scope.

Connect-MgGraph -Scopes User.ReadWrite.All

You will also need to make sure the UsageLocation is set for the user before assigning any license plans, e.g. US for the United States and CA for Canada, etc. To find out all the accounts in your tenant that don’t have a UsageLocation value, run the command below.

Get-MgUser -Select Id,DisplayName,Mail,UserPrincipalName,UsageLocation,UserType | where { $_.UsageLocation -eq $null -and $_.UserType -eq 'Member' }

To assign a license plan to a specific user,

Set-MgUserLicense  -UserID $userID -AddLicenses @{SkuID = $skuID} -RemoveLicenses @()

You can retrieve the license SKUID like this, where $partNumber is the name of the license plan, such as SPB for Business Premium, etc.

$skuID = (Get-MgSubscribedSku -All | Where-Object SkuPartNumber -eq $partNumber).SkuID

To remove a license plan from a specific user,

Set-MgUser-License -UserID $userID -RemoveLicenses @($skuID) -AddLicenses @()

To remove all license plans from a specific user,

Get-MgUserLicenseDetail -UserId $userID | ForEach-Object {Set-MgUserLicense -Userid $userID -RemoveLicenses @($_.skuid) -AddLicenses @()}

References:

• View Microsoft 365 Licenses and Services with PowerShell

To stop it, you will need to add a Transport Rule that catches them via a matching message header. However, since SPF is only one of the authentication methods for email security. There are also DKIM and DMARC to consider as well.

Exchange Online runs authentication tests and puts the results in a header called “Authentication-Results“, in the form of something like this:

Authentication-Results: spf=pass; dkim=pass; dmarc=pass; compauth=pass

The field compauth is a very interesting one. According to Anti-spam message headers in Microsoft 365, it’s used by Microsoft 365 to combine multiple types of authentication or any other part of the message to determine whether or not the message is authenticated.

It would be perfect for my case. If any message’s Authentication-Results header contains compauth=fail, I am happy to drop it. However, the Transport Rule doesn’t take that part and for whatever reason, it just wouldn’t match. What a bummer.

So, naturally, my next bet would be to use DMARC. Here is how it goes.

Head over to the Exchange Admin dashboard, go to Mail flow > Rules, and click Add a rule.

Give a name, and add a condition that

If the message header Authentication-Results includes dmarc=faile

Do the following actions, such as redirect to quarantine, or reject it back to the sender with or without an explanation.

Since we are using DMARC, I believe we should respect its action setting too. So an exception might be necessary.

Except if the message header Authentication-Results includes 'dmarc=fail action=none'

To wrap it up, a rule like this should get the job done.

Creepy as hell, so I decided to put a stop to this by adding a Transport Rule that drops any read receipt right there.

Go to the Exchange admin center, and Rules under Mail flow. Click Add a Rule to create a rule with the following conditions,

• The recipient is external, outside the organization, and
• The message properties include the message type ReadReceipt, and
• The sender is inside the organization.

and do the following action,

• Block the message and delete the message without notifying anyone.

I’d suggest adding a Generate incident report action for a period of time to make sure the rule works the way you designed.

Heading over to the SharePoint admin center and signing in with a Global Admin account.

Click the More features on the left pane and the Open button under the User profiles section.

A classic SharePoint admin page opens up. Click Manage User Profiles under People.

Type the name of the account into the Find profiles box and click the Find button to find the user account. Once found, right-click the account and choose Manage Site Collection Owners.

Now you can add more users to the Administrator’s group and click the OK button once done.

Once it’s all set, that user’s OneDrive folder will be showing up automatically in the newly added administrator’s OneDrive folder.

And that’s why it’s a big headache when it stopped working in the middle of the day.

Following the standard drill, I restarted the server, verified and confirmed the credentials, and reentered the same credentials. Nothing works.

SSH into the server, and pulled up the last 50 entries of the mailroom log from the following command.

sudo tail -n 50 /var/log/tron/mail_room/current

And here is what I found.

Something is blocking it because it makes no sense why the login failed when the credential is 100% working.

I recall I got a support email from Microsoft 365 not long ago about the basic authentications being disabled to my M365 tenant.

So I head over to my M365 admin portal, opened up the Help sidebar, and fired up this command.

dia: enable basic authentication in exchange online

The result? Exchange Online IMAP4 Basi Auth Disabled.

So what now? There is actually a box below the message that allows you to re-enable the service.

One minute after I updated the setting, emails started to follow again in the Spiceworks system. Amazingly effective.

It works for now but what happens when Microsoft permanently disables the Basic Authentication in October?

Stay tuned, I asked the question to the Spiceworks Community, and was told:

We are working on a plan and will keep you posted.

/update on Sept. 28, 2022/

Well, Spiceworks decided to kill the product because of this Basic Authentication being depreciated and suggested anyone who uses Spiceworks Helpdesk Server migrate over to the cloud version instead. I’ve decided to go in another direction, move over to Freshdesk instead.

To view the total and available free storage space currently for your organization, go to Active sites in the SharePoint admin center, and check the numbers at the top right corner of the page.

So how is the total number calculated in the first place?

According to SharePoint Limits, if you are a small business, you probably get 1 TB plus 10 GB per license purchased. But the math doesn’t really add up here. I don’t actually have 170 licensed users in this tenant. So it still seems to be a mystery to me.

Now that I am almost out of the space. I have two choices, either pay an additional monthly fee to get more space or delete some old sites to free up more space.

If you choose to go with the latter, you will need a detailed usage report to see where to begin the process.

In Admin Dashboard, go to Reports > Usage, and click View More under SharePoint activity.

Switch to Site Usage, and you will see the detailed usage of each site listed a little bit down the page.

However, for privacy concerns, both Site URL and Site owner columns are concealed. The report actually is useless with all concealed numbers and letters. To avoid that, you will need to go to Settings > Org settings, click on Reports, and uncheck the option “Display concealed user, group, and site names in all reports”.

Once done, refresh the Site Usage page and click on the Export button to download the usage list.

Head over to Exchange Online Admin Portal, and go to the Rules under the Mail flow section.

Click the + sign to start creating a new rule.

Name the new rule, such as Bypass Spam Filter, select The sender’s domain is as the rule, and type in the domain(s) you would like to whitelist. Note that if you don’t see this rule from the dropdown list, click More options… at the bottom left of the dialog box.

Then, in the action box, select Modify the message properties > set the spam confidence level (SCL), and pick Bypass spam filtering from the list.

Finally, check the option “Stop processing more rules”, and click Save to save the rule.

To confirm, use the Message trace feature to make sure the emails from the whitelisted domain are delivered, instead of marked as FilteredAsSpam.

Once you turn on the archive mailbox, you immediately got up to 100GB of additional storage available to you. And when that additional storage runs out, Microsoft 365 automatically adds more storage space to your archive until the total size reaches 1.5TB if the Auto-Expand feature is turned on. And that is plenty.

To enable the archive mailbox for a specific user:

Enable-Mailbox $userid -Archive

And to enable it for all users that don’t have the archive feature enabled,

Get-Mailbox -Filter {ArchiveGuid -eq '00000000-0000-0000-0000-000000000000' -AND RecipientTypeDetails -eq 'UserMailbox'} | Enable-Mailbox -Archive

Once done, you will see an additional mailbox called Online Archive automatically showing up in Outlook or Outlook Web Access. You can manually move or copy messages between your primary mailbox and the archive one. Or, simply let the retention policy that is set in place take care of the business for you.

And the nice about it, you can easily search for it by simply switching the search option from Current Mailbox to All Mailboxes.

Even though the retention policy will kick in right away, you won’t see the actual archiving process happen right away. It is managed by the Managed Folder Assistant but if you can’t wait and would like to see that happen right away,

Start-ManagedFolderAssistant -Identity $userid

To check a mailbox’s archive status and archive quota,

Get-Mailbox $identity | Select DisplayName, ArchiveStatus, ArchiveQuota

To check how much online archive space was used for a certain mailbox,

Get-MailboxStatistics $identity -Archive | Select DisplayName, TotalItemSize

The default retention policy is to archive anything that is 2 years old. If that’s not enough, you can set up a new retention policy to shorten the period.

New-RetentionPolicy "Archive 1 Year" -RetentionPolicyTagLinks "Personal 1 year move to archive"

And assign the new policy to the mailbox that needs it.

Set-Mailbox $identity -RetentionPolicy "Archive 1 Year"

Finally, when the online storage runs out of space, it’s time to turn on the Auto-Expand feature, either do it on a mailbox level,

Enable-Mailbox $identity -AutoExpandingArchive

Or, do it at the organizational level.

Set-OrganizationConfig -AutoExpandingArchive

And to check whether a mailbox’s auto-expanding is on,

Get-Mailbox $identity | Select AutoExpandingArchiveEnabled
Get-OrganizationConfig | Select AutoExpandingArchiveEnabled

For regular Microsoft 365 groups, you can simply go to the Exchange Dashboard, open the group, switch to the Settings tab, and uncheck the option “Allow external senders to email this group“.

To make these changes in PowerShell,

Set-UnifiedGroup -Identify $group -RequireSenderAuthenticationEnabled $true

That won’t work if these groups are synced from an on-premise Active Directory. In that case, you will need to set the msExchRequireAuthToSendTo attribute to True in AD’s group properties.

And if you have many to update, the following PowerShell script can lend a hand.

$groups = Get-ADGroup -Filter * -SearchBase "OU=Groups,DC=TestDomain,DC=Local"
$newvalue = $true

ForEach ($group in $groups){
    $groupinfo = [ADSI]"LDAP://$($user.DistinguishedName)"
    $groupinfo.put('msExchRequireAuthToSendTo', $newvalue)
    $groupinfo.setinfo()
    $group.name + ' ' + $groupinfo.msExchRequireAuthToSendTo
}

A much better option is to use PowerShell and let the server do all the work. And one cmdlet that just does the job is Search-Mailbox.

Here is how it goes.

First of all, connect to Exchange Online.

Connect-ExchangeOnline

An Office 365 login window pops up, sign in with an account that is a member of the Discovery Management role. You can log in as a Global Admin and go to Exchange > Permissions to edit the Discovery Management role.

Then, to move all emails from one mailbox to another,

Search-Mailbox $sourcemailbox -TagertMailbox $targetmailbox -TargetFolderName $targetfoldername

All three parameters are required. Messages will be copied to the target mailbox under the specified folder name. The structure goes like this:

TargetFolderName\Date of the search\Primary Mailbox\Inbox

It works like a charm. However, there is one limitation. It only returns 10,000 results per mailbox. So, for a larger mailbox or a larger amount of messages to move around, use the New-ComplianceSearch instead, which is a lot more complex.

If you want to see how big the mailbox is you are dealing with, use the -EstimateResultOnly switch.

Search-Mailbox $sourcemailbox -EstimateResultOnly

You can also use the -SearchQuery switch to narrow down the messages that you want to migrate, such as subject line, To or From.

Search-Mailbox $sourcemailbox -SearchQuery "Subject: Away Today"

And if you need to do a dry run, use -LogOnly.

Need very detailed log for the operation? -LogLevel Full is your friend.

Lastly, to make this all happen, you need to be part of the Discovery Management role in Office 365.