Category Archives: Software

Microsoft 365 ownerless groups policy email message body format and content

4 Replies

When you are creating or updating “Microsoft 365 ownerless groups policy” – you can customize email template subject and message body.

Here is how out-of-the-box email message looks like for admin:

Here is how out-of-the-box email message looks like for user:

You can customize subject, message body and link in the footer.
You can use variables: $User.DisplayName to insert the user’s name and $Group.Name to insert the name of the group.

Message body size is limited to 1040 symbols, so not much you can put there. Which means you’ll probably need to share the link to some page in SharePoint where you can provide users more information – explain everything – why it is happening and what are the actions need to be done with screenshots etc. So you’d need a link here – clearly visible in the e-mail body (OotB “Policy guideline Url” appears at the end of the email barely visible).

You’d also emphasize some elements of the message… but how?
It seems like e-mail template does not support HTML tags… and there is no WYSIWYG experience.

Here is what I found out: although policy e-mail template does not support markup, you still can use some tricks as long as e-mail client understands it. Specifically, you can use GitHub-style formatting as described here.

In my experience – both – outlook web-client and outlook desktop app interpret GitHub-wiki-style markup well. I.e. you can use headers, bold/italic text, lists/bullets, links and images.

Here is admin editing e-mail experience:

Here is user e-mail experience:

e.g.

[Link Text](Url) - will look like a link
# will look like a header #
Please refer to a GitHub formatting syntax for a full syntax

N.B. if you forward the message – you might loose formatting.

You might want use Microsoft’s “My groups” page, or “Groups I own” and “Groups I am in” pages.

Example of e-mail subject:

Subject: $Group.Name group needs a new owner

Example of e-mail template:

Hi $User.DisplayName, 

This group currently does not have an owner:
## $Group.Name
You're receiving this email because you've been an active member of the group.  

Per organization's policy, the group requires an owner. **Ownerless groups are subject for deletion.**
For more details - please refer to ["Organization's ownerless resources policy"](https://vladilen.com/office-365/ownerless-microsoft-365-groups-teams-and-sites). 
Please accept or decline this before ...

References

Microsoft 365 People Search by Nickname and Full Name

3 Replies

Scenario

Nickname (or alias or moniker or hypocorism etc.) is some another name – usually shorter than original name and widely used in maybe all countries in the world. E.g. Bob is a nickname for Robert in the US and GB, Checo is the other name for Sergio in Mexico. There might be personal names also – e.g. Bapu (father) is an word that is usually associated with Mohandas Karamchand Gandhi, also known as the Mahatma Gandhi. More examples: David “Noodles” Aaronson, Roger Keith “Syd” Barrett etc.

In Microsoft 365 we want to search for a person’s name we know – and in many cases it’s a nickname – e.g. Beth (Bethany) or Alex (Alexander). Can m365 search do that?

Unfortunately, not… At least at 19:38 on 2023-03-30
… though please check Microsoft 365 Search: built-in people search by nickname.

Solution

It takes a few steps to implement search by nickname:

  • create a custom property under SharePoint Online User Profiles service
  • fill this property with values
  • configure Search Schema – map crawled property to managed property

Step-by-Step

Create a custom property under SharePoint Online User Profiles service

  • Ensure you have a SharePoint Administrator role activated
  • Navigate to SharePoint Admin Center – more features – User Profiles – Manage user properties – New Property
  • Configure custom property according to your needs,
    – ensure “Policy Settings” “Default Privacy Setting:” Everyone is selected
    – ensure “Search Settings” “Indexed” is selected

Fill SharePoint Online User Profile Properties with values

That would be a custom solution – e.g. manual work from SPO Admin Center GUI or PowerShell script ( e.g. with some dictionary). This is required for search to pick it up, crawl the property and create crawled property – so you could proceed with search schema mapping.

Configure Search Schema – map crawled property to managed property

For the nickname to be generally available in full-text-search – i.e.
user simply enter value in a search bar and gets results – here are the steps:

  • Ensure you have a SharePoint Administrator role activated
  • Navigate to SharePoint Admin Center – More features – Search – Manage Search Schema
  • Select Crawled Properties and ensure search picked up your custom property and crawled it – check your crawled property name under Category: People.
  • Under Managed Properties – create a new managed property
    • select “Searchable”
    • under Advanced searchable settings – select Full-text index: PeopleIdx
  • map this managed property to crawled property

========================================

References

Microsoft 365 Search Vertical KQL query field limits

1 Reply

What is the Microsoft Search KQL query field limits for a verticals? Is there limited number of characters or lines?

You know what is Microsoft 365 Search Vertical and what is KQL query in vertical configuration, right?

Microsoft 365 Search Vertical KQL query field limits

Under Microsoft 365 admin center Search and intelligence you can configure search verticals. There are some out-of-the-box verticals – like All, Files, Sites, People and you can configure custom one.

As a part of vertical configuration – you can specify KQL query – if you want e.g. limit search with some sites or content types etc.

The question is – how many sites I can specify in this query field? E.g. can I specify 1000 sites? 10k sites?

And the answer is: It does not matter, because the limit is not in number of characters or lines.

In my dev environment I was able to save 50,000 lines (~3M characters). But attempt to save 100K lines (6M symbols) has failed (due to timeout, I believe:

Again, as I said the problem is not here.

The problem is time required for search to apply query. I.e. when you ask search to bring you something – after it gets results from index and before display results to you it applies KQL query configured for the vertical. And this time is the bottleneck.

Here is what I got measuring search response time depending on query size:

Searchresponse time,
seconds		KQL query
# of lines		KQL query size,
# of symbols
works150028,000
works5100059,000
works92000120,000
works253000180,000
works/fails303500208,000
fails353600214,000
fails3550,0003,000,000
n/an/a100,000
(can’t save KQL query		6,000,000
(can’t save KQL query)

Which means that after ~ 1000 lines (50,000 characters) KQL query size – query becomes too slow, and after ~3000 lines (180k chars) – can fail (due to timeout I’d say).

DepartmentId 

If your sites are organized in hierarchy under Hub site – you can use DepartmentId managed property to significantly decrease number of lines in query,
as you can cover all sites under the hub with

DepartmentId=<HubSiteId>


Adaptive scopes Retention Policies Data Lifecycle Purview

1 Reply

Microsoft recently implemented “Adaptive” retention policies. At step 2 of “Create retention policy” you’ll be asked “Choose the type of retention policy to create”: “A policy can be adaptive or static. Advantage of an adaptive policy will automatically update where it’s applied based on attributes or properties you’ll define. A static policy is applied to content in a fixed set of locations and must be manually updated if those locations change.”

And if you selected “Adaptive” – on the next step you will need to provide the adaptive scope (so at this moment you should already have created your adaptive scopes):

So, let us create your adaptive scopes.
What type of scope do you want to create? SharePoint sites…

And then you’ll have nothing more then set of conditions:

where you can use objects: “Site Url”, “Site Name” and “Refinable String 0″..”Refinable String 99”. Conditions would be “is equal to”, “is not equal to”, “starts with” and “not starts with”. Or you can select “Advanced query builder” and enter KQL query.

Advanced query builder for SharePoint Adaptive Scope

Microsoft 365 Retention Policies SharePoint Adaptive Scopes Advanced Query

External Access Guest Access Microsoft 365 SharePoint Teams

Leave a reply

I will be saving my personal gotchas on Microsoft 365 External Access and Guest Access in SharePoint and Teams

We configure external/guest access in AAD, m365 Admin Center, Teams Admin Center, SharePoint Admin Center, specific Group, Team or SharePoint site.

We can configure external guest access directly, or can configure sensitivity labels and policies in Purview (Compliance Admin Center). Configuring sensitivity labels for sites/groups we configure external guest access settings. Configuring sensitivity labels policies we apply labels.

External access via “All Users” group

Be careful with “All users” group created as part of the process.
Microsoft: “The dedicated All Users group includes all users in the directory, including guests and external users.” And indeed, “All Users” group by default include external users.

So here is the scenario: we have a site where external sharing is enabled, and someone is sharing a specific file1 or folder1 with some external users. The other site/group member is sharing another file2/folder2 with “All Users” assuming All Users means all this group member. This gives external users access to file2/folder2.

Remediation

Option 0: remove “All Users” group

Option 1: exclude External users or Guest users from “All Users” group:

(user.userPrincipalName -notContains "#EXT#@")
or 
(user.userType -ne "Guest")

(explained here).

Option 2: schedule a job that removes “All Users” from all sites UIL. Optionally inform site owners not to use “All Users” but use “Everyone except external users”.

SharePoint Site Template, Look Book and PnP Provisioning Engine

4 Replies

Aug 2024 Update: you cannot apply site template from Look Book. You must use PowerShell to apply a Look Book template to your site.

Here is the article: Applying PnP Templates to SharePoint Sites

Some templates can be applied by regular users (site admins) and some templates would require SharePoint tenant admin permissions. But now it’s only via PowerShell. You can get an idea how templates look like at

PnP provisioning engine is something that us used under the hood.

If you are interested in automation of provisioning templates – please let me know in comments below or via site feedback.

===============================

So the information below is obsolete and I will keep it just for the sake of history of SharePoint:

SharePoint Look Book

SharePoint Look Book – a site with a collection of modern SharePoint site templates. You can browse through dozens of good-looking templates… but how do you apply chosen template to your site?

Gotcha #1

There is a button “Add to your tenant>” and it says “You must be a tenant administrator to deploy this template.” Really? No… but
Actually, SharePoint Administrator role is required to apply template from lookbook.
So yes, tenant-level admin role but just SharePoint service admin role.
Site admin role is not enough…

Gotcha #2

Next, when you try to get template by clicking “Add to your tenant>” button, it actually offers you to create a new site. But it also says “…can use existing URL”. Really? No.
When you type existing site Url into the “Relative URL to be used for the site” field –
You can get “Can’t add this template. The provided site is already in use and the current template cannot be provisioned onto an already existing site. Please provide a different URL” message:

Or, if you managed to enter existing Url, you might get: “Unfortunately your site provisioning at least partially failed!”:


References:

Sensitivity labels in Microsoft Teams, Microsoft 365 groups, and SharePoint sites

Leave a reply

Note: When you follow instructions provided by Microsoft, beware that “Connect-AzureAD” works only in Windows .net framework – i.e. PowerShell 5.1.
if you try to run it in PowerShell 7 – you can get “Connect-AzureAD: One or more errors occurred. (Could not load type ‘System.Security.Cryptography.SHA256Cng’ from assembly ‘System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089’.)” Error.
(check Connect-AzureAD Could not load type ‘System.Security.Cryptography.SHA256Cng’ from assembly)

Configuring Sensitivity Labels

Sensitivity labels are configured under Microsoft Purview (Compliance Center), Solutions, Information Protection. You’d need a global admin or “Compliance Administrator” or “Azure Information Protection Administrator” (?) role:

Since we are talking sensitivity labels for SharePoint Sites (not documents), we define label scope as “Groups and Sites”: “Configure privacy, access control, and other settings to protect labeled Teams, Microsoft 365 Groups, and SharePoint sites.”

Then we define which protection settings for groups and sites we should configure on the next steps:
– Privacy and external user access settings – Control the level of access that internal and external users will have to labeled teams and Microsoft 365 Groups.
– External sharing and conditional access settings – Control external sharing and configure Conditional Access settings to protect labeled SharePoint sites.

If we selected previously “Privacy and external user access settings” – now we need to select group/team privacy (These options apply to all Microsoft 365 Groups and teams, but not standalone sites). When applied, these settings will replace any existing privacy settings for the team or group. If the label is removed, users can change privacy settings again. You can also allow external user access – if group owner will be able to add guests:

Next step – define external sharing and conditional access settings. Specifically, if the content of the SharePoint site can be shared with Anyone (anonymously) or with authenticated users (new or existing) or no external sharing is allowed:

And you can either control the level of access users have from unmanaged devices or select an existing authentication context to enforce restrictions:

Configuring sensitivity labels policies

Sensitivity label policy is basically which label should be available to apply for what users and some other settings like
– do users need to provide justification before removing a label or replacing it with one that has a lower-order number or
– will users be required to apply labels and optionall the default label

View existing sensitivity labels

“Global reader” role allows view existing sensitivity labels configuration:

Wording would be a little different, but all aspects of the label configuration will be mentioned. E.g. when editing GUI says label scope is “Groups & sites”, read-only label summary defines Scope as “Site, UnifiedGroup”.

Gotchas

Site sensitivity label is applied to site collection only and cannot be applied to subsite (web object).

Applying sensitivity labels programmatically

To apply a label to a m365 group or Teams site with a group behind: MS Graph API support only Delegated permissions.

“Set-PnPSiteSensitivityLabel” works in the current site context.
Description says “If the site does not have a Microsoft 365 Group behind it, it will set the label on the SharePoint Online site and will not require Microsoft Graph permissions and will work with both delegate as well as app only logins.”
In fact (7/22/2022) app permissions are not working. This cmdlet can assign label to a standalone or a group-based site only with delegated permissions.

“Set-PnPTenantSite” allows you to remove or apply site sensitivity label to both standalone and group-based sites with app permissions. Furthermore, group and team settings respect this. I.e. if you apply label to a group-based site – group will pick this up.

Channel sites should inherit sensitivity label from root site.
I’m not sure if it’s a bug but
– when you create a team and select sensitivity label as part of team creation process – all the channel sites you create after (Private or Shared) will inherit sensitivity label immediately
– when you apply sensitivity label to an existing team – with existing channel sites – in this case Private channel sites inherit team sensitivity label immediately, but with Shared channel sites it’s strange: GUI shows sensitivity label assigned, but site object model does not.

References