Just can't get enough of IT

Wouldn't it be nice if you could stay in Microsoft Teams even when working with your emails? Microsoft Teams is getting even more mature by providing an App for integrating Outlook into the Microsoft Teams client.

At least it seems that this is the case. or was it?

The Outlook App (Preview)

Last week a new App, still in preview, showed up in the Teams Admin Center (TAC) of some demo tenants. I filtered the list of available apps using Outlook as a search term.

When selecting the app, the details showed that the app was still in preview (v0.41).

As long as the app is enabled within Teams, you can add the app to a Teams Setup Policy and make it available for users.

Your users can then access the Outlook App using the Teams app bar.

You can simply click on Outlook in the app bar and, voilá, you have your Outlook inbox in Microsoft Teams. Due to the architecture of Microsoft Teams, you have access to your Outlook on the Web version of your inbox.

Links

• Learn more about Microsoft Teams 
• Teams App Setup Policy
• Learn more about today

Enjoy Microsoft Teams and Microsoft Outlook. - And remember today's date.

I am honored to speak at TeamsFest 2020. 

TeamsFest 2020 is a TeamsFest is a 100% free, 100% community-driven conference dedicated to Microsoft Teams. It aims to bring together exceptional technical talent and thought leaders to democratize knowledge about Microsoft Teams, encourage participation in the Microsoft Teams community, and give those who are struggling financially an opportunity to attend a first-class Teams conference.

My session will cover the requirements for implementing an Exchange Hybrid configuration with Exchange Online when utilizing on-premises mailboxes with Microsoft Teams.

Date

• 7th October
• 08:00h - 18:30h (CEST)

Links

• TeamsFest 2020 Registration
• TeamsFest Overview and agenda

See you at TeamsFest 2020!

I am honored to speak at Teams Nation 2021 on 12th May about Microsoft Teams Admin Roles and Teams Admin Center. 

Register today and visit my session in room Teams Nation Germany (TCD). As suspected, the session will be in German.

Teams Nation is a community conference and offers 115 sessions in 11 tracks.

Visit the conference site and register today.

• Teams Nation Conference
• Teams Nation Schedule
• Register for Teams Nation Conference

Microsoft 365 Groups are the backbone of various Microsoft 365 workloads. As you might know, each group utilizes a SharePoint site collection, and an Exchange shared mailbox.

When you create a new Microsoft 365 group, SharePoint Online must store the associated site collection somewhere. SharePoint Online uses predefined paths to determine the storage location. These paths are called: Managed Paths.

SharePoint Online uses two different pre-configured managed paths:

• /sites
• /teams

With /sites as the default setting for the Microsoft 365 tenant.

Whenever you create, e.g., a new team in Microsoft Teams, the associated site collection is stored in https://TENANTNAME.sharepoint.com/sites/TEAMNAME. As a SharePoint administrator, you see the site collection paths in the list of active sites in the SharePoint Admin Center.

But what can you do, if you want to store the associated site collections in the /teams managed path?

Changing the Managed Path

The SharePoint Admin Center provides you with an option to change the managed path for sites, created by users. 

Open the SharePoint Admin Center, navigate to Settings -> Site Creation.

Change the setting for Create team sites under to /teams/.

The description of this setting is misleading. This setting affects not only SharePoint team site creation initiated by users on the SharePoint start page or OneDrive, but site collections created by Microsoft 365 Groups as well.

You do not need to enable the checkbox to let users create sites from the SharePoint start page and OneDrive. This setting is only required, when you want to enable self-service site creation of modern SharePoint sites for users. The modern SharePoint sites are based on Microsoft 365 Groups.

After changing the path, SharePoint Online creates new associated site collections for Microsoft 365 Groups in /teams/.

Enjoy SharePoint Online.

You might have the requirement to authenticate mobile devices and authorize user access to on-premises Exchange Server mailboxes using a multi-vendor strategy. This blog post focuses on the configuration of a Kemp LoadMaster located in an internal network segment. The Kemp LoadMaster ESP functionality is used to allow ActiveSync connections for members of a dedicated security group only.

This results in the following authentication and authorization endpoints:

• MobileIron access policies
• Kemp LoadMaster ESP security group membership validation
• Exchange Server ActiveSync client access allowance 
• Exchange Server mobile device policy

Overview

The following diagram shows a simplified overview for mobile devices connecting to an on-premises Exchange Server. The perimeter and internal network segments are omitted for simplification reasons.

1. A MobileIron managed device connects to MobileIron Sentry which validates access with MobileIron policies
2. If a MobileIron policy allows access the device connects to Kemp LoadMaster ESP
3. Kemp LoadMaster ESP configuration validates the security group membership of the authenticating user
4. If the user is a member of the security group, the device connects to Exchange Server
5. Exchange Server authenticates the user and checks, if the ActiveSync protocol is enabled and the device complies with Exchange Server MDM configuration

Kemp LoadMaster Virtual Service

The following screenshots illustrate a working setup for a virtual service load balancing mobile device connections from MobileIron Sentry to Exchange Server. It's assumed that you've already configured the following:

• SSO Domain settings for connecting to a domain controller to authenticate users

SSL Properties

The SSL Traffic is offloaded and re-encrypted as we need to authenticate the user with ESP. Ensure to select a Cipher Set that does not provide any weak or unsecure cipher suites. In this example I've selected the predefined set BestPractices.

ESP Options

Enable ESP to activate the ESP configuration section. The settings are as follows:

• Client Authentication Mode: Basic Authentication
  Be aware that this setting requires that MobileIron users are provisioned using DOMAIN\SamAccountName notation and not the UPN Name
• SSO Domain: An existing SSO Domain configuration for user authentication
• Allowed Virtual Hosts: The FQDN matching the Load Master virtual service IP address accessed by MobileIron Sentry to connect to Exchange Server
• Allowed Virtual Directories: Can be limited to /Microsoft-Server-ActiveSync otherwise leave the default /*
• Permitted Groups: The name of the Active Directory security group containing the allowed users
• Server Authentication Mode: Basic Authentication

Real Servers

In the Real Servers section you add all member servers of your Exchange Server DAG. Ensure to use the HTTPS protocol the health checks and ensure to query the /Microsoft-Server-ActiveSync/healthcheck.htm document.

Using this configuration you've added your Kemp LoadMaster as an additional authentication endpoint to secure mobile device access to Exchange Server mailboxes.

Enjoy!

Starting September 11th 2017 Microsoft Teams supports guest access for external users. 

Guest access for Microsoft Teams uses a separate guest license type that must be activated in the services & add-ons section of the Office 365 Admin portal. 

Office 365 Admin portal notification:

When we make this change, the ‘Pick the license you want to configure’ setting in ‘Settings > Services and Add-ins > Microsoft Teams’, will now have an option for ‘Guest’ with a default value of “off” for the ‘Turn Microsoft Teams on or off for your entire organization’ setting.

When you've not activated guest licenses, external user receive an odd error when trying to access your shared team.

Link

• Expand your collaboration with guest access in Microsoft Teams

Enjoy Office 365!