Just can't get enough of IT

Problem

You can block an user from logging on to Office 365 by setting the BlockCredential attribute to $true.

Set-MsolUser -UserPrincipalName myuser@mcsmemail.de -BlockCredential $true

But the MSOL user attribute is reverted to $false, when ADD Connect synchonization cycle runs.

This happens, because the local Active Directory attribute accountEnabled is used to controll the BlockCredential attribute in Azure AD.

Solution

If your IT operation requires the ability to have enabled users in your local Active Directory infrastructure and you need to prevent logon to cloud services you need to prevent the accountEnabled attribute from being synchronized to Azure AD. This might not necessarily be a general requirement during normal operations, but might be useful while doing a Proof-of-Concept.

Just exclude the attribute from the Azure Active Directory connector in the Synchronization Service Manager.

The following script disables all users excluding

• Users following a specific naming pattern
• Users listed in a string array

# Userfilter
$UserExceptions = ("Sync_SYNC01_add98768492f@mcsmemail.onmicrosoft.com","SPO-SRV-ACCOUNT@mcsmemail.de","SynchedAdmin@mcsmemail.de")

# Fetch synchronized users 
$DomainAccounts = Get-MsolUser -EnabledFilter EnabledOnly -MaxResults 5000 | Where-Object -Property LastDirSyncTime -ne $null

# Select synchronized users not following the pattern ADM*@mcsmemail.de (admin accounts in this case)
$DomainAccountsWithoutAdmins =  $DomainAccounts | Where-Object -Property UserPrincipalName -notlike "ADM*@mcsmemail.de"

# Exclude accounts listed in $UserExceptions
$DomainAccountsWithoutAdminsFiltered = $DomainAccountsWithoutAdmins | Where-Object -Property UserPrincipalName -NotIn $UserExceptions
 

# Now block cloud logon for all filtered users
ForEach ($User2Block in $DomainAccountsWithoutAdminsFiltered) {
  Write-Host ('Disabling User: {0}.UserPrincipalName)' -f $User2Block)
  Set-MsolUser -UserPrincipalName $User2Block.UserPrincipalName -BlockCredential $true
}

Enjoy Office 365.

Description

Using this script you can test the domain availability in Office 365 and Azure AD. As there are different closed Office 365 and Azure AD regions you need to test per dedicated closed Office 365 region.

Regions currently implemented:

• Global
  This is the default public Office 365 cloud
• Germany
  This is the dedicated Germany Cloud offering aka Office 365 Germany
• China
  This is the Office 365 region hosted by VIANET21

The script queries the login uri for the selected Office 365 region.

The response contains metadata about the domain queried. If the domain already exists in the specified region the metadata contains information if the domain is verified and/or federated.

 Load function into your current PowerShell session:

. .\Test-DomainAvailability.ps1

Examples

# EXAMPLE
# Test domain availability in the default region - Office 365 Global

Test-DomainAvailability -DomainName example.com 

# EXAMPLE
# Test domain availability in Office 365 China    

Test-DomainAvailability -DomainName example.com -LookupRegion China

Version History

• 1.0, Initial community release

Links

• Download and follow at Github: https://github.com/Apoc70/Test-DomainAvailability
• Download at TechNet Gallery: https://gallery.technet.microsoft.com/Test-Office-365Azure-AD-5301c105

Additional Credits

Original source: https://blogs.technet.microsoft.com/tip_of_the_day/2017/02/16/cloud-tip-of-the-day-use-powershell-to-check-domain-availability-for-office-365-and-azure/

Follow

• Twitter @stensitzki
• LinkedIn
• Xing