When you are creating or updating “Microsoft 365 ownerless groups policy” – you can customize email template subject and message body.
Message body size is limited to 1040 symbols, so not much you can put there. Which means you’ll probably need to share the link to some page in SharePoint where you can provide users more information – explain everything – why it is happening and what are the actions need to be done with screenshots etc. So you’d need a link here – clearly visible in the e-mail body (OotB “Policy guideline Url” appears at the end of the email barely visible).
You’d also emphasize some elements of the message… but how? It seems like e-mail template does not support HTML tags…
I found out that although policy e-mail template does not support markup, you still can use some tricks as long as e-mail client understands it. Specifically, you can use GitHub-style formatting as described here.
In my experience – both – outlook web-client and outlook desktop app interpret GitHub-wiki-style markup well. I.e. you can use headers, bold/italic text, lists/bullets, links and images.
Here is admin editing e-mail experience:
Here is user getting e-mail experience:
[Link Text](Url) - will look like a link # will look like a header # Please refer to a GitHub formatting syntax for a full syntax
N.B. if you forward the message – you’ll loose formatting.
What is the Microsoft Search KQL query field limits for a verticals? Is there limited number of characters or lines?
You know what is Microsoft 365 Search Vertical and what is KQL query in vertical configuration, right?
Under Microsoft 365 admin center Search and intelligence you can configure search verticals. There are some out-of-the-box verticals – like All, Files, Sites, People and you can configure custom one.
As a part of vertical configuration – you can specify KQL query – if you want e.g. limit search with some sites or content types etc.
The question is – how many sites I can specify in this query field? E.g. can I specify 1000 sites? 10k sites?
And the answer is: It does not matter, because the limit is not in number of characters or lines.
In my dev environment I was able to save 50,000 lines (~3M characters). But attempt to save 100K lines (6M symbols) has failed (due to timeout, I believe:
Again, as I said the problem is not here.
The problem is time required for search to apply query. I.e. when you ask search to bring you something – after it gets results from index and before display results to you it applies KQL query configured for the vertical. And this time is the bottleneck.
Here is what I got measuring search response time depending on query size:
response time, seconds
KQL query # of lines
KQL query size, # of symbols
100,000 (can’t save KQL query
6,000,000 (can’t save KQL query)
Which means that after ~ 1000 lines (50,000 characters) KQL query size – query becomes too slow, and after ~3000 lines (180k chars) – can fail (due to timeout I’d say).
Microsoft recently implemented “Adaptive” retention policies. At step 2 of “Create retention policy” you’ll be asked “Choose the type of retention policy to create”: “A policy can be adaptive or static. Advantage of an adaptive policy will automatically update where it’s applied based on attributes or properties you’ll define. A static policy is applied to content in a fixed set of locations and must be manually updated if those locations change.”
And if you selected “Adaptive” – on the next step you will need to provide the adaptive scope (so at this moment you should already have created your adaptive scopes):
So, let us create your adaptive scopes. What type of scope do you want to create? SharePoint sites…
And then you’ll have nothing more then set of conditions:
where you can use objects: “Site Url”, “Site Name” and “Refinable String 0″..”Refinable String 99”. Conditions would be “is equal to”, “is not equal to”, “starts with” and “not starts with”. Or you can select “Advanced query builder” and enter KQL query.
Advanced query builder
Advanced query builder allows us to use more site properties then “Site Url”, “Site Name” and “Refinable Strings” and more conditions than “is (not) equal to” and “(not) starts with”.
E.g. we can use “Title”, “Created”, “Modified” site properties and “=”,”:”,”<“, “>”, “<=”, “>=” conditions.
Working queries examples:
created>12/31/2021 AND modified>=7/31/2022
Not working queries examples:
RefinableString11 = Birds # (do not use spaces in advanced query)
Query against custom site property (aka property bag value)
You can create custom site property and assign value to the property with Set-PnPAdaptiveScopeProperty or Set-PnPPropertyBagValue. Property must be with “Indexed” parameter. Once the property is set up, m365 search crawls site and creates crawled property. Then you map crawled property to some pre-created refinable string managed property. You can assign alias to this managed property.
In my test scenario I used RefinableString09 with alias SiteCustomSubject.
Site property value
does not work
does not work
does not work
does not work
Query against multi-value property.
Site property value
RefinableString09 = ‘TestA TestB’
does not work
??? RefinableString09=’Test10 Test5′
does not work
does not work
does not work
(basic) RefinableString09 starts with test
What is the takeaway from this for SharePoint administrators? We would be asked to configure SharePoint the way compliance/retention people can use Refinable Strings.
Will be saving gotchas on Microsoft 365 External Access and Guest Access in SharePoint and Teams
We configure external/guest access in AAD, m365 Admin Center, Teams Admin Center, SharePoint Admin Center, specific Group, Team or SharePoint site.
We can configure external guest access directly, or can configure sensitivity labels and policies in Purview (Compliance Admin Center). Configuring sensitivity labels for sites/groups we configure external guest access settings. Configuring sensitivity labels policies we apply labels.
beware that “Connect-AzureAD” works only in Windows .net framework – i.e. PowerShell 5.1 if you try to run it in PowerShell 7 – you can get “Connect-AzureAD: One or more errors occurred. (Could not load type ‘System.Security.Cryptography.SHA256Cng’ from assembly ‘System.Core, Version=220.127.116.11, Culture=neutral, PublicKeyToken=b77a5c561934e089’.)” Error. (check Connect-AzureAD Could not load type ‘System.Security.Cryptography.SHA256Cng’ from assembly)
Configuring Sensitivity Labels
Sensitivity labels are configured under Microsoft Purview (Compliance Center), Solutions, Information Protection. You’d need a global admin or “Compliance Administrator” or “Azure Information Protection Administrator” (?) role:
Since we are talking sensitivity labels for SharePoint Sites (not documents), we define label scope as “Groups and Sites”: “Configure privacy, access control, and other settings to protect labeled Teams, Microsoft 365 Groups, and SharePoint sites.”
Then we define which protection settings for groups and sites we should configure on the next steps: – Privacy and external user access settings – Control the level of access that internal and external users will have to labeled teams and Microsoft 365 Groups. – External sharing and conditional access settings – Control external sharing and configure Conditional Access settings to protect labeled SharePoint sites.
If we selected previously “Privacy and external user access settings” – now we need to select group/team privacy (These options apply to all Microsoft 365 Groups and teams, but not standalone sites). When applied, these settings will replace any existing privacy settings for the team or group. If the label is removed, users can change privacy settings again. You can also allow external user access – if group owner will be able to add guests:
Next step – define external sharing and conditional access settings. Specifically, if the content of the SharePoint site can be shared with Anyone (anonymously) or with authenticated users (new or existing) or no external sharing is allowed:
And you can either control the level of access users have from unmanaged devices or select an existing authentication context to enforce restrictions:
Configuring sensitivity labels policies
Sensitivity label policy is basically which label should be available to apply for what users and some other settings like – do users need to provide justification before removing a label or replacing it with one that has a lower-order number or – will users be required to apply labels and optionall the default label
View existing sensitivity labels
“Global reader” role allows view existing sensitivity labels configuration:
Wording would be a little different, but all aspects of the label configuration will be mentioned. E.g. when editing GUI says label scope is “Groups & sites”, read-only label summary defines Scope as “Site, UnifiedGroup”.
Applying sensitivity labels programmatically
To apply a label to a m365 group or Teams site with a group behind: MS Graph API support only Delegated permissions.
“Set-PnPSiteSensitivityLabel” works in the current site context. Description says “If the site does not have a Microsoft 365 Group behind it, it will set the label on the SharePoint Online site and will not require Microsoft Graph permissions and will work with both delegate as well as app only logins.” In fact (7/22/2022) app permissions are not working. This cmdlet can assign label to a standalone or a group-based site only with delegated permissions.
“Set-PnPTenantSite” allows you to remove or apply site sensitivity label to both standalone and group-based sites with app permissions. Furthermore, group and team settings respect this. I.e. if you apply label to a group-based site – group will pick this up.
Q: What permission or role is required to get search Usage analytics reports A: To see Microsoft 365 Search and intelligence usage analytics reports you’d need “Global reader” or “Search editor” role.
Q: What permission or role is required to get access to Search Feedback under Microsoft 365 admin center – Settings – Search & intelligence – Insights – Feedback A: You’d need at least “Global reader” or “Search editor” role.
I’ve got a new machine, installed Visual Studio Code but it did not start.
My Visual Studio Code just stuck on start showing a blue frame and “Visual Studio Code” – “The window is not responding” message: “You can reopen or close the window or keep waiting”, after a while:
code --verbose --log debug --disable-extensions
[704:0622/103533.849:ERROR:gpu_process_host.cc(983)] GPU process exited unexpectedly: exit_code=-1073741819
[704:0622/103533.850:WARNING:gpu_process_host.cc(1288)] The GPU process has crashed 1 time(s)
[704:0622/103538.853:ERROR:gpu_process_host.cc(983)] GPU process exited unexpectedly: exit_code=-1073741819
[704:0622/103538.853:WARNING:gpu_process_host.cc(1288)] The GPU process has crashed 2 time(s)
[704:0622/103543.835:ERROR:gpu_process_host.cc(983)] GPU process exited unexpectedly: exit_code=-1073741819
[704:0622/103543.835:WARNING:gpu_process_host.cc(1288)] The GPU process has crashed 3 time(s)
[main 2022-06-22T05:35:45.833Z] CodeWindow: detected unresponsive
It turned out this Electron issue is to blame. It is recommended to avoid –no-sandbox flag as it disables application sandbox for all processes, since this issue is isolated to the gpu process –disable-gpu-sandbox should serve as an alternative.
Just run Visual Studio Code with “–disable-gpu-sandbox” parameter:
Note: if one instance is started this way, second instance is started the regular way
Note: it seems the issue happens with vscode versions 1.66-1.68, so workaround would be return to v 1.65
Note: since the issue is some kind of conflict between new versions of vscode and new machine’s GPU – this might happen when you upgrade a vscode or upgrade your hardware or both.