• How does Sign IN work?
  
• • The client reaches teams.skype.com and start the bootstrap. Under JSON we should be able to view all features are enabled or not enabled:
    
  • The page teams.microsoft.com will present a sign in page with a frame from login.microsoftonline.com and follow an OAUTH authentication.
  • https://login.microsoftonline.com/common/userrealm/ - will return where the OAUTH auth will happen.

• A token will be generated and the client and can be verified on the 302 message from login.microsoftonline.com:
  

• Token expires_in=3599 (1h)
• From this point the client execute all the requests with the access token on the HTTP header:

• How does the client identify where to register?
  • The client will always attempt to register to teams.microsoft.com that is the URL of the service.
  • Once registered, the client will POST to api.teams.skype.com that will reply with a JSON with the services the client have to register:
    The client do authenticated requests to the ams, chat service, middleTier, msImageService and search services on respective geographical region.

• How does Sign IN work in SSO?

• Was user able to sign in before?
  • Provisioning Issue?
• How widespread is the sign-in failure?
  • 1 user, few users, All users in the tenant
• What is the Repro rate?
  • Intermittent
  • Consistent
• What clients are impacted?
  • Web
  • Windows
  • Mac
• Networks where sign-in fails
  • Corp
  • VPN to Corp
  • Public Internet (Shopping complex, airports, etc)

• Initial steps when investigating a sign in problem:
  • Issue is isolated to specific network
    • Likely cause is a Firewall blocking at a perimeter network
  • Issue is impacting all users everywhere
    • Likely cause is with entitlement or other issue authenticating to the service
      • Possible SSO or 2fA issue.
• Gather app logs or web traffic tracing (Fiddler)
  • From bottom of the log search for key words
  • Example or "err_" or "error" or "failed"
  • From Fiddler trace, you can filter Example Process=Teams.exe
    • Search for anything unusual like a 4xx or 5xx response that suggests something is missing or there is an error. (Recommend opening "Raw" view in Inspectors)

1. Fiddler
2. Log files.txt

1. In case of Firewall issue – You may see an HTTP response in Fiddler traces will suggest firewall is blocking
                                                                                                                                                                                                       ** Screen shot referred from demo pptx.

• Example of time out issue (Electron Log file)
                                                                                                                                                                                                      ** Screen shot referred from demo pptx.
• Example of time-out issue (Fiddler Trace, Response Inspector)
                                                                                                                                                                                                       ** Screen shot referred from demo pptx.

• Teamwork - Based on today's requirement to easily communicate and share with others you want to work with, including people outside your organization. Anyone with an Azure Active Directory (Azure AD) account can be added as a guest in Teams. That means anyone who is present as a user in Azure AD whether being licensed or not with any service/invited user should be valid Office 365 domain user or synced from On-Premise Active Directory to Azure AD using Directory Synchronization.
• Public accessibility- We’re introducing the ability to add anyone as a guest in Microsoft Teams. This means that anyone with a business or consumer email account, such as Outlook.com, Gmail.com or others, can participate as a guest in Teams with full access to team chats, meetings and files.
  Previously, anyone with an Azure Active Directory (Azure AD) account could be added as a guest, and now anyone with an email address can be added to a team. All guests in Teams are covered by the same compliance and auditing protection as the rest of Office 365, and can be managed securely within Azure AD.
• Security and compliance - We have kept Teams to provide enterprise-grade security and compliance assurances. In Teams, guest accounts are added and securely managed within Azure AD. This enables enterprise-grade security, like conditional access policies for guest user access. In addition, with Azure AD, IT departments have unparalleled insight into the activities of external users in their organization through detailed sign-in and access reports. Guest user content and activities are reported under compliance and auditing reporting of Office 365.
• IT manageability - Guest access in Teams comes with the ability for IT to centrally manage how guests participate within their Office 365 environment, providing consistency across application experiences in Office 365. IT admins can quickly and easily view, add, or revoke a guest's access to the host tenant.

1. From your teams list, just click  next to the team name, and then click Add members.

1. Login to https://aad.portal.azure.com to manage group and members
   
2. Manage Audit logs and activity as per below screen shot
3. To manage users from Azure AD PowerShell, we need to follow following steps:
   1. Install Azure AD PowerShell modules from Azure Active Directory PowerShell Module and sign-in assistance from Microsoft Online Services Sign-In Assistant for IT Professionals RTW.
   2. Open Windows PowerShell as Administrator
   3. Run Import-Module MSOnline
   4. After Step C, run Connect-MsolService
      
   5. Once, prompted for User Name & Password, provide Global Administrator credentials for the tenant you want to manage Guest Accounts.
   6. To get the list of Guest Accounts in a tenant run:
      Get-MsolUser -All | where {$_.UserType -eq "Guest"}
   7. To change display name for guest user:
      Set-MsolUser -UserPrincipalName "TU1_akumase3.onmicrosoft.com#EXT#@anuagartest.onmicrosoft.com" -DisplayName "Test Guest User 1"
   8. Verify if display name has been changed:
      
   9. To disable guest user without deleting:
      Set-MsolUser -UserPrincipalName "TU1_akumase3.onmicrosoft.com#EXT#@anuagartest.onmicrosoft.com" -BlockCredential $True
   10. To remove guest user from tenant:
       Remove-MsolUser -UserPrincipalName "TU1_akumase3.onmicrosoft.com#EXT#@anuagartest.onmicrosoft.com"

• Service Scoped: Is scoped for every country where Cloud PBX is available. Each user is automatically assigned with this dial-plan and it cannot be altered.
• Tenant Scoped: It can further be broken into 2 types of Dial-Plan:
  • Tenant Scope – It is customizable and applied to all users in respective tenant
  • User Scope – It is customizable and applies to specific users

1. Service Dial-Plan: If no tenant global dial plan is scoped & user global dial plan is assigned to provisioned user then user will inherit Service Dial Plan mapped to country with their Office 365 usage location
2. Tenant Global: If tenant global dial plan is defined and no user global dial plan is assigned to provisioned user then user will inherit effective dial plan merged with tenant dial plan and service dial plan
3. User Global: If user global dial plan is defined and assigned to provisioned user then user will inherit effective dial plan merged with user global dial plan and service dial plan mapped to country with their Office 365 usage location

• PS C:\WINDOWS\system32> (Get-CsDialPlan US).Normalization | FT Name,Description,Pattern,Translation

• $nr1 = New-CsVoiceNormalizationRule -Parent Global -Name Test1 -Pattern "^(\d{4})$" -Description "Number with 181" -Translation '+1816406$1' -InMemory
• $nr2 = New-CsVoiceNormalizationRule -Parent Global -Name Test2 -Pattern '^([2-9]\d{7})$' -Description "Local number normalization for Australia" -Translation '+613$1' -InMemory
• New-CsTenantDialPlan  -Identity DialPlan-Test1 -NormalizationRules @{Add=$nr1,$nr2}

• Grant-CsTenantDialPlan -PolicyName DialPlan-Test1 -Identity john.depp@anuagar.info

After signing out and back in from the Skype for Business client, the additional normalization rules are now applied.

Update Global Tenant Dial Plan with Normalization Rules

• $nr1 = New-CsVoiceNormalizationRule -Parent Global -Name Test1 -Pattern "^(\d{4})$" -Description "Number with 181" -Translation '+1816406$1' -InMemory
• Set-CsTenantDialPlan -Identity Global -NormalizationRules @{Add=$nr1}

• Grant-CsTenantDialPlan -PolicyName $null -Identity John.Depp@anuagar.info

• Remove-CsTenantDialPlan -Identity Tag:DialPlan-Test1 -Force

• Get-CsEffectiveTenantDialPlan -Identity John.Depp@anuagar.info| Select-Object -ExpandProperty NormalizationRules

• Get-CsEffectiveTenantDialPlan -Identity John.Depp@anuagar.info | Test-CsEffectiveTenantDialPlan -DialedNumber 2423456578

• (Get-CsDialPlan US).NormalizationRules | FT Name,Description,Pattern,Translation,IsInternalExtension

• Hope the above information is helpful