Ashour's blog

Tip of the day: isMemberOf Transpot rule is not firing

A.Ashour — Wed, 31 May 2017 08:42:19 GMT

This tip is for customers running dedicated exchange and MT, though it will probably raise in hybrid scenarios as well.

In this scenario the MX record is sending the traffic to MT environment and the transport rule is based on isMemberOf.

Description : If the message:

Is sent to a member of group 'allusers@contoso.com'

and Includes these words in the message subject: 'Recognition Summary'

and Is received from 'Outside the organization'

Take the following actions:

Set audit severity level to 'Low'

and Delete the message without notifying the recipient or sender

and Stop processing more rules

and Send the incident report to admin@contoso.com, include these message properties in the report: sender, recipients, subject, cc'd recipients,

bcc'd recipients, severity, sender override information, matching rules, false positive reports.

The transport rule was firing for all group members except a single user, Alex.

Alex mailbox resides in ANSI and Exchange had no issue to resolve Alex’s external address but then fails to lookup the external address in the address book.

The address book lookup is looking for a proxy address for Alex@mgd.contoso.com but that was missing so the solution was quite simple, add the external address to the proxy address attribute.

Enjoy

Ahmed Ashour

Service Engineer II

Bad relationship meaning no Free/Busy

A.Ashour — Sat, 27 May 2017 12:32:32 GMT

TL;DR – if you have a bad personal relationship then you will lose free/busy :)

I’ve recently worked with one of our o365 customers to investigate a free/busy issue not working across forest in one direction from X1@contoso.com -----x> to Y1@datum.com

It’s working for everyone else, even X1 is able to see the f/b of Y2.

X2 who is in the same database with X1 is able to see the f/b of Y1 and Y2.

The first and easiest way to move forward is to draw the scenario and think how we can approach the issue.

The first question to ask if the user can reproduce that in both owa and outlook and if we can have a decrypted fiddler trace from OWA.

Walking through the fiddler trace, here we go, the exception is:

{"MessageText":"Proxy web request failed. , inner exception: System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a receive. ---> System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. ---> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host

The exception doesn’t make any sense, specially that X2@contoso.com is able to see the free/busy so we can’t really relay on that exception.

Permission issue ?

The default user is granted availability only permission which is what we need for organization relationship.

We also don’t have any explicit permissions for X1 or X2.

PS > Get-MailboxFolderPermission -Identity Y1@datum.com:\Calendar
FolderName           User                 AccessRights
----------           ----                 ------------
Calendar             Default              {AvailabilityOnly}

To avoid ACL stale issues we moved X1 and Y1 mailbox but that didn’t change anything.

So what’s so special between the two users ?!

To answer this question I decided to take an extra trace from X1 backend server in a live session with the customer as we couldn’t find any useful data in IIS\Café Ews\EWS\event viewer logs.

The extra trace is confirming that they have a personal relationship but what kind of personal relationship do they have ?

"InfoWorker.RequestDispatch","RequestRouting", Found a personal relationship for Y1@datum.com

Looking at the source code, I found that we evaluate if there's a personal sharing between the two users and we query the f/b based on that.

But where do we store the personal sharing data ?

The subscription is stored as a hidden message in the folder "\root\sharing" and you can use MFCMAPI to check that.

The subscription message class is: IPM.ExternalSharingSubscription.

PropertyTag    : 80C9001F
PropertyId     : SharerIdentity:80C9:Unicode(f52a8693-c34d-4980-9e20-9d4c1eabb6a7:ExternalSharingSharerIdentity)
PropertyType   : Unicode
PropertyName   : f52a8693-c34d-4980-9e20-9d4c1eabb6a7:ExternalSharingSharerIdentity
EntryType      : Value
SerializedSize : 32
CanonicalSize : 54
PropertyValue : Y1@datum.com

PropertyTag    : 80C6001F
PropertyId     : Url:80C6:Unicode(f52a8693-c34d-4980-9e20-9d4c1eabb6a7:ExternalSharingUrl)
PropertyType   : Unicode
PropertyName   : f52a8693-c34d-4980-9e20-9d4c1eabb6a7:ExternalSharingUrl
EntryType      : Value
SerializedSize : 62
CanonicalSize : 114
PropertyValue : https://mail..datum.com/EWS/Exchange.asmx/WSSecurity

If the environment is on-premises you can leverage store query in exchange 2013\2016 instead of MFCMAPI.

$mbx=get-mailbox x1@contoso.com
$mbxNumber=Get-StoreQuery -Database $($mbx.Database) -Query "Select MailboxNumber From Mailbox Where MailboxGuid = '$($mbx.ExchangeGuid)'"
$folders=Get-StoreQuery -Database $mbx.Database -Query "select * from Folder where MailboxPartitionNumber = '$($mbxNumber.MailboxNumber)' and DisplayName like '%Sharing%'" $messages=$folders | %{Get-StoreQuery -Database $mbx.Database -Query "select * from Message Where MailboxPartitionNumber = '$($mbxNumber.MailboxNumber)' and FolderId = '$($_.FolderId)' and MessageClass = 'IPM.ExternalSharingSubscription'" -Unlimited}
$blob=@(Get-StoreQuery -Database $mbx.Database -Query "Select * From ParsePropertyBlob($($messages[0].PropertyBlob), 'Message',$($mbxNumber.MailboxNumber))") $blob | where{$_.PropertyName -like '*ExternalSharing*'}

$blob

We didn’t finish yet

Does that mean that f/b will always fail if the calendar sharing is used ?

Let’s introduce another user in the story, X3.

If Y1 shared her calendar with X3, X3 will automatically granted explicit permission over Y1 calendar.

If the explicit permission is removed or missing then the f/b won’t work.
Sounds like we have a way to resolve the issue and a solid understanding of the root cause.

Enjoy

Ahmed Ashour

Service Engineer II

Multi threading public folder report

A.Ashour — Thu, 05 May 2016 03:42:00 GMT

Have you ever run 7 TB of data resident in public folders with over 400K folders?

What if you want to generate a report that show some statistics about these folders and the permissions assigned to each folder ? do you imagine how much of time you need to complete that report ? it could take weeks to finish such a report.

What could cause such a delay ?

1- Commands are taking time to process each folder

2- Loop techniques are handling folders in serial mode

But aren’t PowerShell running in .net so why not to run in multithreading ?

Of course we need to make sure that we won’t slow down exchange by this and we won’t be throttled by the system but is it possible ?

The answer is YES if you can split the code in a way to run in parallel mode and to do that let’s see the below example and walk through the stages.

#Stage 0: Some global variables, you can easily change the server name or even loop in all servers from a single location
$Svr = "mydeve14”
$ResultSize = “unlimited”
$Date = Get-Date -DisplayHint Date
$SDate = ($Date).ToShortDateString() -replace(“/”,”-“)

#Stage 1: get all Folder statistics from the server
$Folders = Get-PublicFolderStatistics -Server $Svr -ResultSize $ResultSize -EA 0| select Name,FolderPath, Databasename, CreationTime, Identity, ItemCount, LastUserAccessTime, LastUserModificationTime, OwnerCount, TotalItemSize, AssociatedItemCount, TotalAssociatedItemSize

#Stage 3: We define what kind of information we want to extract from each folder inside the script block, stage 2 will be at the end
$ScriptBlock = {
Param (
$Folders,
[int]$PageSize,
[int]$Offset,
[int]$RunNum,

[string]$conn

)

$Svr = "mydeve14”

. 'C:\Program Files\Microsoft\Exchange Server\V14\bin\RemoteExchange.ps1'

connect-exchangeserver "$conn.mylab.dev" -allowClobber

#3.1 Define the log name
$Log = “c:\codes\pfstate\PFStats$SDate-$Svr-$RunNum.txt”

#3.2 Select folders based on page size and offset
$Folders = $Folders | select-object -skip $Offset -First $PageSize
$PFCnt = $Folders.count #Total number of folders
“Number of Folders: $PFCnt”

#3.3 Write the log header
“$Svr Public Folders as of $Date Total number of Folders: $PFCnt” > $Log
$now = [DateTime]::Now
“FolderName`tPath (PFID)`tDatabaseName`tItem Count`tTotal Item Size (KB)`tAssociated Item Count`tAssociated Item Size (KB)`tOldest Content`tNewest Content`tCreation Date`t Last User Access Date`tLast User Modification Date`tClient Permissions” >> $Log #File Header

#3.4 Let’s do a Foreach loop to get the item statistics for each folder
foreach($folder in $Folders){
"processing $($folder.name)"
$Db=$Folder.DatabaseName
$PFID = “\” + $folder.FolderPath
$Count = $folder.itemcount
$Size = 0 #TotalItemSize
$Size = $Folder.TotalItemSize.value.toKB()
$CTime = $Folder.CreationTime.ToShortDateString() #Creation Date
$ATime = If ($Folder.LastUserAccessTime){$Folder.LastUserAccessTime.ToShortDateString()}
$MTime = If ($Folder.LastUserModificationTime) {$Folder.LastUserModificationTime.ToShortDateString()}
$AssocItemCt = $Folder.AssociatedItemCount #Attachments?
$AssocItemSize = $Folder.TotalAssociatedItemSize.value.toKB() #Attachment size?
$Contents = $null #Dates of folder content
$Oldest = $null #Date of oldest content
$Newest = $null #Date of newest content

#3.4.a check the newest and oldest items
$Contents = Get-PublicFolderItemStatistics -Identity $PFID -Server $Svr | Select CreationTime | Sort CreationTime
If ($Contents) {If ($Items -eq “1”) {
    $Oldest = $Contents.CreationTime | Get-Date -Format dd/MM/yyyy
    $Newest = $Contents.CreationTime | Get-Date -Format dd/MM/yyyy
    } Else {
    $Oldest = $Contents[0].CreationTime | Get-Date -Format dd/MM/yyyy
    $Newest = $Contents[$Items – 1].CreationTime | Get-Date -Format dd/MM/yyyy
    } }

#3.4.b Let’s check the client permissions for each folder
$Perm=$null
Get-PublicFolderClientPermission -Identity $PFID -Server $Svr | Select User,@{Name='AccessRights';Expression={[string]::join(', ', $_.AccessRights)}} | %{$Perm+="$($_.User)#$($_.AccessRights);"}
$Perm.TrimEnd(";")

#3.4.c Output to log file
“$Name`t$PFID`t$Db`t$Count`t$Size`t$AssocItemCt`t$AssocItemSize`t$Oldest`t$Newest`t$CTime`t$ATime `t$MTime `t$Perm” >> $Log

} #Ending the loop
Get-Date -Format g >> $Log
} #Ending the script block

# Stage 2: Let’s start the funny part to spawn multiple threads, we create as much threads as we want # to handle 1000 threads, you may need to check PowerShell throttling policy so that you have # no limits for your admin account running this script
#2.1: Set the pagesize and the number of threads we need, we limit the threads to 4 to avoid impacting CPU

$Offset=0;

$numThreads = 3

#check if the division has remainder or we will have an int number # +1 as we start with thread 0 and that results on 4 thread 0,1,2,3

[int]$remainder = $Folders.count % ($numThreads+1)

#int number to avoid decimals, also change the pagsize to by dynamic based on the number of folders and the threads we intend to run

[int]$PageSize = $Folders.count / ($numThreads+1)

#2.2: create the powershell runspace
$myString = "this is session state!"
$sessionState = [System.Management.Automation.Runspaces.InitialSessionState]::CreateDefault()
$sessionstate.Variables.Add((New-Object -TypeName System.Management.Automation.Runspaces.SessionStateVariableEntry -ArgumentList "myString" ,$myString, "session state"))
$RunspacePool = [RunspaceFactory]::CreateRunspacePool(1, 4, $sessionState, $host)
$RunspacePool.Open()

#2.3 Start numThreads threads each on a dedicated server and increase the offset

$servers=@("server01","server02”,”server03”,”server04”)
0..$numThreads | % {

    #Increase the last thread with the remainder

    if($_ -eq $numThreads)

    {

        $PageSize = $PageSize + $remainder

    }

      "Start at offset $($Offset) till $($Offset+$PageSize)"

    #Due to processing issues, we are running each thread in a dedicated server

    $Conn=$servers[$_]

    "Will connect to $($conn)"

    $Job = [powershell]::Create().AddScript($ScriptBlock).AddParameter("Folders",$Folders).AddParameter("Offset",$Offset).AddParameter("PageSize", $PageSize).AddParameter("RunNum",$_).AddParameter("conn",$conn)
    $Job.RunspacePool = $RunspacePool
    $Job.BeginInvoke()
    $Offset+=$PageSize
}

Upon testing running in multi thread was able to retrieve the results for 26k from a single server in less than 1 hour while the normal foreach loop in a single thread last for more than 7 days and didn’t finish the job.

Enjoy

Ahmed Ashour

Support Escalation Engineer

# THIS CODE IS SAMPLE CODE. THESE SAMPLES ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. # MICROSOFT FURTHER DISCLAIMS ALL IMPLIED WARRANTIES INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR OF FITNESS FOR # A PARTICULAR PURPOSE. THE ENTIRE RISK ARISING OUT OF THE USE OR PERFORMANCE OF THE SAMPLES REMAINS WITH YOU. IN NO EVENT SHALL # MICROSOFT OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF BUSINESS PROFITS, # BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, OR OTHER PECUNIARY LOSS) ARISING OUT OF THE USE OF OR INABILITY TO USE THE # SAMPLES, EVEN IF MICROSOFT HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. BECAUSE SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION # OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, THE ABOVE LIMITATION MAY NOT APPLY TO YOU.

Tip of the day: Where are the delivery restriction settings for resource mailboxes ?

A.Ashour — Thu, 05 May 2016 01:12:53 GMT

If you moved from exchange 2010 to 2013 SP1 you will notice that you are no more able to see the message delivery restriction settings in ECP for resource mailboxes, they are gone

But hold on, the feature is not removed, it’s just the ECP no more showing the options.

You still can manage the message delivery restriction using exchange shell.

Set-Mailbox can do the job with the parameters “–AcceptMessagesOnlyFrom”, “-AcceptMessagesOnlyFromDLMembers”, “-RequireSenderAuthenticationEnabled”, “-RejectMessagesFrom “,“-RejectMessagesFromDLMembers”,

This example configures the mailbox of Azure Meeting Room to accept messages only from the users Lori Penor, Jeff Phillips, and members of the distribution group Legal Team 1.

Set-Mailbox -Identity "Azure Meeting Room" -AcceptMessagesOnlyFrom "Lori Penor","Jeff Phillips" -AcceptMessagesOnlyFromDLMembers "Legal Team 1"

This example adds the user named David Pelton to the list of users whose messages will be accepted by the resource mailbox.

Set-Mailbox -Identity "Azure Meeting Room" -AcceptMessagesOnlyFrom @{add="David Pelton"}

This example configures the resource mailbox to require all senders to be authenticated. This means the mailbox will only accept messages sent by other users in your Exchange organization.

Set-Mailbox -Identity "Azure Meeting Room" -RequireSenderAuthenticationEnabled $true

This example configures the resource mailbox to reject messages from the users Joe Healy, Terry Adams, and members of the distribution group Legal Team 2.

Set-Mailbox -Identity "Azure Meeting Room" -RejectMessagesFrom "Joe Healy","Terry Adams" -RejectMessagesFromDLMembers "Legal Team 2"

This example configures the resource mailbox reject messages sent by members of the group Legal Team 3.

Set-Mailbox -Identity "Azure Meeting Room" -RejectMessagesFromDLMembers @{add="Legal Team 3"}

Enjoy

Ahmed Ashour

Support Escalation Engineer

Tip of the Day: How to force the max message size for cloud users

A.Ashour — Fri, 28 Aug 2015 14:22:25 GMT

If you are running a hybrid setup and your company policy is forcing max message size of 10mb then how you can force cloud users not to send more than 10mb ?

It’s not just that the cloud users can send more than 15mb emails, they also will have NDRs from the on-prem servers if they send internal communication more than 15mb.

Changing the max send size or receive size is not something you can achieve in the cloud even if you escalated to the product group and the Microsoft support however you can create a transport rule in the office365 portal to drop any emails that has an attachment larger than or equal 15mb

Enjoy

Ahmed Ashour
Support Escalation Engineer

Tip of the Day: How to limit SMTP applications to send from a specific mailbox

A.Ashour — Fri, 28 Aug 2015 12:50:26 GMT

It’s easy to allow an smtp application to send emails through your exchange servers but it’s not easy to force the application admin to use a certain sender address.

The receive connectors doesn’t provide such feature but you still have the option to create a transport rule to check the header and reject the email unless it’s coming from the desired mailbox.

Enjoy

Ahmed Ashour
Support Escalation Engineer

Fix duplication in default folders KB3031133 & KB3069501 & kb2991934

A.Ashour — Fri, 28 Aug 2015 05:46:21 GMT

In exchange 2013 prior to CU9, if you migrate your mailbox to exchange 2013 you might see duplicates in the default folders

The same issue you may face if you are moving the mailbox from one server to another server using the –IgnoreRuleLimitErrors switch

The update will fix the issue for new migration/mailbox move and our job is to fix it for the migrated/moved mailboxes

The ultimate objective is to move old items to the new default folders and after that delete the folders

Let’s take that a bit by bit:

1- The new default folder is empty and old data is stored in the old folder which is no more a default

2- You can delete the old folder

3- The new default folder usually have the same name suffixed with 1/2/3, for example drafts1 or drafts2

So far, it’s doable to check the WellKnownFolderName and see which one is default and which one is not the default but we still have more details yet to cover

4- In some cases if the default language used to be French, the new default folder change to English
for example, the brouillons folder change to be drafts

This point forced me to rethink and reconsider to write a map in the folder names for different languages.
As I was working with a French customer I will share the French map and you can follow the same if you have the same symptoms.

The source folder is the French folder and the target is the one with English, you can apply any combination you want.

folderlist.csv
"Source","Target","Type"
"Calendrier","Calendar","Default"
"Contacts","Contacts","Default"
"boîte de réception","Inbox","Default"
"brouillons","Drafts","Default"
"Journal","Journal","Default"
"tâches","Tasks","Default"
"courrier indésirable","JunkEmail","Default"
"boîte d'envoy","sent items","Default"
"éléments supprimés","deleted items","Default"
"RSS Feeds","RSS Feeds1","Search"

5- Some folders are created by outlook and are duplicated also after the move and are not default folders, like the “RSS Feeds”
if you want to change that you can add them to the list and change the type to “search”

6- What about Folder Names ?

Outlook.exe /ResetFolderNames is the best way to get the folders back to the default name after we delete the old folders for sure.
That will change the folder to the default settings in your computer, so if you run it from a computer with French language you will have Calendrier instead of Calendar for example.

Now, let’s talk about the script.

The script will move all old items from the old folders to the new default folders and once that completed, the script will remove the old folders.

You need impersonation or full access rights to all mailboxes you would like to fix

The script will ask you to provide a csv file with the list of mailboxes in the following format

Identity
TestE15sv05@myzoo.dev

Example:

.\Fix-DefaulltFolders.ps1 -UseAutodiscover $false -UseDefaultCredentials $true -EwsUrl https://mye15cas01.mylab.dev/ews/exchange.asmx -Verbose -CsvFile ListOfMbx.csv

<#
.SYNOPSIS
Fix-DefaultFolders.ps1

.DESCRIPTION
    You need to be assigned full mailbox access or impersonation permissions before you can run this script.
    Moving mailboxes using “-IgnoreRuleLimitErrors” will cause duplicate folders, issue is descriped on kb/2991934
    The duplicate folders are created with different languages
    This script will move all items from the old folders to the new default folders
    The script will delete the old folder if it has 0 items.
.NOTES
    Author       :      Ahmed Ashour - ahmed.ashour@hotmail.fr
    Creation Date:         v0.1 08 June 2015
    Last Update :      v0.4 02 July 2015
    Update       :      Add the ability to fix the RSS Feeds based on Search
                        Remove duplicates for working set and conversation action settings
    Customer     :         ------------------
    Ticket Ref   :        ------------------

# DISCLAIMER:
# THIS CODE IS SAMPLE CODE. THESE SAMPLES ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.
# MICROSOFT FURTHER DISCLAIMS ALL IMPLIED WARRANTIES INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR OF FITNESS FOR
# A PARTICULAR PURPOSE. THE ENTIRE RISK ARISING OUT OF THE USE OR PERFORMANCE OF THE SAMPLES REMAINS WITH YOU. IN NO EVENT SHALL
# MICROSOFT OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF BUSINESS PROFITS,
# BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, OR OTHER PECUNIARY LOSS) ARISING OUT OF THE USE OF OR INABILITY TO USE THE
# SAMPLES, EVEN IF MICROSOFT HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. BECAUSE SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION
# OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, THE ABOVE LIMITATION MAY NOT APPLY TO YOU.

.PARAMETER CsvFile
The input csv File with primary smtp addresses

.PARAMETER EWSURL
The EWS URL set in exchange

.PARAMETER Impersonate
The default value is [bool]$Impersonate = $false
Use this parameter if you have a service account that can impersonate multiple mailboxes

.PARAMETER UseAutodiscover
The default value is [bool] -UseAutodiscover = $true
If you have issues with autodiscover you can need to set the parameter to $false and use the EWSURL paraemter.

.PARAMETER UseDefaultCredentials
The default value is [bool] -UseDefaultCredentials = $true
If you need to run the script with any other credintials other than the loggedn in powershell user, then you need to set this parameter to $false
and provide the other username, password and domain parameters

.PARAMETER UserName
UserName that will be used for authentication
The userName for O365 has to be the complete UPN.

.PARAMETER Password
Passowrd that will be used for authentication

.PARAMETER Domain
The AD domain name that will be used for authentication if you are running onpremise enviroment only.

.PARAMETER Delete
Delete the Old Folders

.Example

.\Fix-DefaulltFolders.ps1 -UseAutodiscover $false -UseDefaultCredentials $false -EwsUrl https://mye15cas01.mylab.dev/ews/exchange.asmx -Username TestE15Mbx01@mylab.dev -Password Passowrd1 -Verbose -CsvFile ListOfMbx.csv -delete $True
Run the script for all users in the csv file to move the items from the old folders to the new default folders and delete the old one.
#>
[CmdletBinding(SupportsShouldProcess=$true )]
param (
    [Parameter(Mandatory=$True,HelpMessage="Specifies the input csv file to be accessed")]
    [ValidateNotNullOrEmpty()]
    [string]$CsvFile,
    [bool]$Impersonate = $false,
    [bool]$UseAutodiscover = $true,
    [bool]$UseDefaultCredentials = $true,
    [bool]$TrustAllCertificates = $true,
    [bool]$Delete = $False,
    [string] $Username,
    [string] $Password,
    [string] $Domain,
    [string]$EwsUrl
)

#Common variables
[string]$EWSManagedApiPath = "C:\Program Files\Microsoft\Exchange\Web Services\2.2\Microsoft.Exchange.WebServices.dll"
#[string]$EWSManagedApiPath = "C:\Program Files\Microsoft\Exchange\Web Services\1.2\Microsoft.Exchange.WebServices.dll"
$DateStamp = Get-Date -f "dd-MM-yyyy"
$OutFile="Results-"+$DateStamp+".csv"

if ($TrustAllCertificates -eq $true)
{
    ## Code From https://poshcode.org/624
    ## Create a compilation environment
    $Provider=New-Object Microsoft.CSharp.CSharpCodeProvider
    $Compiler=$Provider.CreateCompiler()
    $Params=New-Object System.CodeDom.Compiler.CompilerParameters
    $Params.GenerateExecutable=$False
    $Params.GenerateInMemory=$True
    $Params.IncludeDebugInformation=$False
    $Params.ReferencedAssemblies.Add("System.DLL") | Out-Null

$TASource=@'
namespace Local.ToolkitExtensions.Net.CertificatePolicy{
    public class TrustAll : System.Net.ICertificatePolicy {
      public TrustAll() {
      }
      public bool CheckValidationResult(System.Net.ServicePoint sp,
        System.Security.Cryptography.X509Certificates.X509Certificate cert,
        System.Net.WebRequest req, int problem) {
        return true;
      }
    }
}
'@

    $TAResults=$Provider.CompileAssemblyFromSource($Params,$TASource)
    $TAAssembly=$TAResults.CompiledAssembly

    ## We now create an instance of the TrustAll and attach it to the ServicePointManager
    $TrustAll = $TAAssembly.CreateInstance("Local.ToolkitExtensions.Net.CertificatePolicy.TrustAll")
    [System.Net.ServicePointManager]::CertificatePolicy = $TrustAll
    write-host -ForegroundColor Yellow "Trusting all certificates!"
}

# Loading ManagedAPI dll
[Void] [Reflection.Assembly]::LoadFile($EWSManagedApiPath)

# Setting up the service
$Service = New-Object Microsoft.Exchange.WebServices.Data.ExchangeService([Microsoft.Exchange.WebServices.Data.ExchangeVersion]::Exchange2013_SP1);

# Setting up credentials
if ($UseDefaultCredentials -eq $true)
{
$Service.UseDefaultCredentials = $true;
}
else
{
$Service.Credentials = New-Object Microsoft.Exchange.WebServices.Data.WebCredentials($UserName, $Password, $Domain);
}

#Function to process the folders
Function ProcessFolders()
{
param($Folder)
    $Source=$folder.source
    $Target=$folder.Target
    $type=$folder.Type
    Write-verbose "processing $($Source) & $($target)"
    $View = New-Object Microsoft.Exchange.WebServices.Data.FolderView(1000);
    #$View.Traversal = [Microsoft.Exchange.WebServices.Data.FolderTraversal]::Deep
    $SearchFilterCollection = New-Object Microsoft.Exchange.WebServices.Data.SearchFilter+SearchFilterCollection([Microsoft.Exchange.WebServices.Data.LogicalOperator]::OR)
    $SearchSource = New-Object Microsoft.Exchange.WebServices.Data.SearchFilter+ContainsSubstring([Microsoft.Exchange.WebServices.Data.FolderSchema]::DisplayName,$Source);
    $SearchTarget = New-Object Microsoft.Exchange.WebServices.Data.SearchFilter+ContainsSubstring([Microsoft.Exchange.WebServices.Data.FolderSchema]::DisplayName,$Target);
    $SearchFilterCollection.Add($SearchSource)
    $SearchFilterCollection.Add($SearchTarget)
    $SourceList=@()
    $SearchFolders = $RootFolder.FindFolders($SearchFilterCollection,$view)
    if($SearchFolders)
    {
        Foreach($FolderObj in $SearchFolders)
        {
            "Found Folder: $($FolderObj.displayName) : will check if it's default"
            $FolderProps = New-Object -TypeName Microsoft.Exchange.WebServices.Data.PropertySet(
            [Microsoft.Exchange.WebServices.Data.BasePropertySet]::IdOnly,
            [Microsoft.Exchange.WebServices.Data.FolderSchema]::WellKnownFolderName,
            [Microsoft.Exchange.WebServices.Data.FolderSchema]::FolderClass,
            [Microsoft.Exchange.WebServices.Data.FolderSchema]::DisplayName,
            [Microsoft.Exchange.WebServices.Data.FolderSchema]::totalcount
            )

            #if($Folder.WellKnownFolderName.length -lt 1)
            if($type -eq "Search")
            {
                $Default=$False
                $Display=$FolderObj.displayName
                $FolderObj.displayName = "Del-$($FolderObj.displayName)"
                try
                {
                    $FolderObj.update();
                }
                catch [exception]
                {
                    $_.Exception.Message
                    $_.Exception.Message | out-file -Append $OutFile
                    $Default=$True
                }

                #if($Folder.FolderClass)
                if($Default)
                {
                    $FolderObj.displayName = $Display;
                    "Found Default folder: $($FolderObj.displayName)"
                    "Found Default folder: $($FolderObj.displayName) : the default folder" | Out-File -Append $OutFile
                    $TargetFolder=$FolderObj
                }
                else
                {
                    $SourceList+=$FolderObj
                    "Found Custom folder: $($FolderObj.displayName) : will add it to the source List"
                    "Found Custom folder: $($FolderObj.displayName) : will add it to the source List" | out-file -Append $OutFile
                }

            }
            else
            {
                $Folder = [Microsoft.Exchange.WebServices.Data.Folder]::Bind($service, $FolderObj.Id, $FolderProps)
                #$Folder.FolderClass
                $Folder.WellKnownFolderName.length
                $Folder.WellKnownFolderName
                if($Folder.WellKnownFolderName.length -eq 1)
                {
                    "Found Default folder: $($FolderObj.displayName)"
                    "Found Default folder: $($FolderObj.displayName)" | out-file -Append $OutFile
                    $TargetFolder=$FolderObj
                }
                else
                {
                    $SourceList+=$FolderObj
                    "Found Custom folder: $($FolderObj.displayName) : will add it to the source List"
                    "Found Custom folder: $($FolderObj.displayName) : will add it to the source List" | out-file -Append $outfile
                }
            }
            <#if($Folder.FolderClass)
            {
                    Write-Verbose "Found $($FolderObj.displayName) to be the Target folder"
                    $TargetFolder=$Folder
            }
            #>
        }

        #Stage 2 move the items
        #if($SourceList -and $TargetFolder)
        #{
            #$SourceList
            Write-Verbose "Start moving To: $($TargetFolder.DisplayName)"
            foreach($SourceFolder in $SourceList)
            {
                Write-Verbose "Start moving from: $($SourceFolder.displayName) To: $($TargetFolder.DisplayName)"
                "Start moving from: $($SourceFolder.displayName) To: $($TargetFolder.DisplayName)" | out-file -Append $OutFile
                #Set parameters - we will process in batches of 1000 for the FindItems call
                $Offset=0;
                $PageSize=500;
                $ItemView = New-Object Microsoft.Exchange.WebServices.Data.ItemView($PageSize, $Offset, [Microsoft.Exchange.Webservices.Data.OffsetBasePoint]::Beginning);
                $ItemView.PropertySet = New-Object Microsoft.Exchange.WebServices.Data.PropertySet([Microsoft.Exchange.WebServices.Data.BasePropertySet]::IdOnly);
                do{
                        $FindResults=$SourceFolder.FindItems($ItemView);
                        ForEach ($Item in $FindResults.Items)
                        {
                            try
                            {
                                $Item.Move($TargetFolder.Id) | Out-Null;
                            }
                            catch [Exception]
                            {
                                $_.exception
                                Write-Host "Failed to move item", $Item.Id.UniqueId -foregroundcolor Red
                            }
                        }
                        $ItemView.Offset+=$FindResults.Items.Count
                        $Offset+=$PageSize
                        "The new offset is: $($ItemView.Offset)"
                }while($FindResults.MoreAvailable -eq $true)

                #Stage3:Delete the old folder
                if($delete -eq $True)
                {
                    if($SourceFolder.totalcount -eq 0)
                    {
                        Try
                        {
                            [void]$SourceFolder.Delete( [Microsoft.Exchange.WebServices.Data.DeleteMode]::SoftDelete )
                            Write-Verbose "Deleting : $($SourceFolder.displayName)"
                            "Deleting : $($SourceFolder.displayName)" | Out-File -Append $OutFile
                        }
                        catch [Exception]
                        {
                            $_.Exception.Message
                            $_.Exception.Message | out-file -append $OutFile
                        }
                    }
                    else
                    {
                        "skipping the delete: $($SourceFolder.displayName) : $($SourceFolder.totalcount)" | out-file -Append $OutFile
                        Write-Verbose "skipping the delete: $($SourceFolder.displayName)"
                    }
                }
            }
        #}

    }
    else
    {
        write-verbose "couldn't find any folders"
    }
}

#Import List Of mailboxes
$ListOfMbx=import-csv $CsvFile
"$($DateStamp)" | Out-File $OutFile

If($ListOfMbx)
{
Foreach($Mailbox in $ListOfMbx)
{

        # Connect to the mailboxes
        # If we are using impersonation then setup impersonation
        if ($Impersonate)
        {
            $Service.ImpersonatedUserId = New-Object Microsoft.Exchange.WebServices.Data.ImpersonatedUserId([Microsoft.Exchange.WebServices.Data.ConnectingIdType]::SmtpAddress, $Mailbox.identity)
        }

        # Setting Autodiscover settings
        if ($UseAutodiscover -eq $true)
        {
            $service.AutodiscoverUrl($Mailbox, {$True});
        }
        else
        {
            $Service.Url = new-Object Uri($EwsUrl);
        }

write-host "Accessing mailbox $($Mailbox.identity)"
"Accessing mailbox $($Mailbox.identity)" | Out-File -append $OutFile

        #Get root folder
        $folderid= new-object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::MsgFolderRoot,$($Mailbox.identity))
        Try
        {
            $RootFolder = [Microsoft.Exchange.WebServices.Data.Folder]::Bind($service,$folderid)
            "Sucessfull authentication to mailbox $($Mailbox.identity)" | Out-File -append $OutFile
            $Go=$True
        }
        Catch [Exception]
        {
            $_.exception.message
            $_.exception.message | Out-File -Append $OutFile
            $Go=$False
        }

        if($Go -eq $true)
        {
            $FoldersList=import-csv folderslist.csv -Encoding Unicode
            ForEach($Folder in $FoldersList)
            {

                    ProcessFolders $Folder
            }
            "=============================="
        }
        else
        {
            Write-Error "you need FullAccess permissions in order to proceed"
            "you need FullAccess permissions in order to proceed" | Out-File -Append $OutFile
        }
    }
}

Enjoy

Ahmed Ashour
Support Escalation Engineer

The untold story of “Use serial migration to migrate public folders to Exchange 2013 from previous versions”

A.Ashour — Wed, 11 Feb 2015 14:12:18 GMT

Today I would like to share some secrets that you have to know when you try to migrate your public folders to the modern public folders following the famous article https://technet.microsoft.com/en-us/library/jj150486(v=exchg.150).aspx

I will focus mainly in four type of errors that I’ve seen repeated frequently during the migration for many customers.

If you follow the steps on the article everything should go through until you start the step 5 where the migration request start.

I will quickly explain three related issues that you may face with mail enabled public folder and normal public folders before we start developing the solution

1- The migration request will start to check every public folder and check the alias property before moving to exchange 2013.

If any special character in the alias found then the migration will throw an exception and won’t process any further folders.

FailureCode                      : -2146233088
FailureType                      : DataValidationException
FailureSide                      : Target
Message                          : Error: Property expression "AAL Ahmed ,22/6/98 " isn't valid. Valid values
                                   are: Strings formed with characters from A to Z (uppercase or lowercase), digits
                                   from 0 to 9, !, #, $, %, &, ', *, +, -, /, =, ?, ^, _, `, {, |, } or ~. One or more
                                   periods may be embedded in an alias, but each period should be preceded and
                                   followed by at least one of the other characters. Unicode characters from U+00A1 to
                                   U+00FF are also valid in an alias, but they will be mapped to a best-fit US-ASCII
                                   string in the e-mail address, which is generated from such an alias.

2- When it tried to change the alias I discovered that some public folders has leading or trailing whitespaces in the Name property.

WARNING: The property value is invalid. The value can't contain leading or trailing whitespace.

It’s possible to change the Name and Alias using set-MailPublicFolder but that is something that you can do when the data validation is OK and you are changing from a valid properties to another valid properties like you change the name from Test01 to Test001 but when you have a trailer whitespace the set-MailPublicFolder will throw the validation exceptions and you won’t be able to use it to change anything.
The command Set-PublicFolder in the other hand don’t perform data validation so we need to change the name first before we can check the alias and change it.

3- The last issue I faced is the wrong proxy addresses in some mail enabled folders.
WARNING: The primary SMTP address, "SMTP:A.H.N.@mylab.dev", is not valid.

Again that will block the set-MailPublicFolder command from changing the alias, so we need to run a proxy address script to fix all wrong proxy addresses and after that we can change the alias and the name properties.

Let’s start then with the proxy addresses script:

Starting from Exchange 2010, if you have some legacy old smtp addresses that are not valid, exchange will save the information into

$Email.ParseException and your job will be to check if you have any exception and remove it using set-mailpublicFolder

"Importing the public folders to the memory"
$listOfPublicFolders=import-csv publicFolders.csv
foreach($Folder in $listOfPublicFolders)
{
        "Start working on $($Folder.identity)"

        $PFFolder=Get-MailPublicFolder $($Folder.identity)
        "Found the folder $($PFFolder.identity)"
        $Error.Clear()
        if($PFFolder)
        {
            write-progress -activity "Remove Wrong Proxy Addresses " -status "Currently processing the PF(alias) : $Folder.Alias"
            $EmailAddresses=$PFFolder.EmailAddresses
            Foreach($Email in $EmailAddresses)
            {
                If($Email.ParseException)
                {
                    Write-Warning "$($PFFolder.alias)#Remove#$($Email.proxyaddressstring)"
                     $Error.Clear()
                    set-mailpublicfolder -identity $PFFolder.alias -alias $($NewAlias) -emailaddresses @{remove=$($Email.proxyaddressstring)}
                    $Error[0].Exception
                }
            }
        }

"Finished working on $($Folder.identity)"
"-------------------------------------------"
}

After we correct the wrong smtp addresses, it’s time to correct the alias and the name properties.

This time I decided to generate a report will all aliases that has a special characters or exceeding 64 char.

Function RegexSearchAndReplace
{
param($Test)

$SpechilaChars = ',','!', '"', '$', '%', '&', '^', '*', '(', ')', '@', '=', '+', '¬', '`', '\', '<', '>', '.', '?', '/', ':', ';', '#', '~', "'",' ' | % {[regex]::escape($_)}

$OrFiltering = [string]::join('|',$SpechilaChars)

    if(select-string -inputobject $test -Pattern $OrFiltering -AllMatches)
    {
        $ValidAlias=$test -replace $OrFiltering, ""

    }
    else
    {
        $ValidAlias="No Change"
    }
    return $ValidAlias
}

"Importing the public folders to the memory"
$listOfPublicFolders=import-csv pflist.csv
"Identity#Oldalias#ValidAlias" | Out-File aliasChange.txt
foreach($Folder in $listOfPublicFolders)
{
    "Start working on $($Folder.alias)"

        $alias=$Folder.alias
        if($alias.length -gt 64)
        {
            write-progress -activity "Checking the publicFolders " -status "Exceeding 64Char: PF(alias) : $alias"
            "$($alias)#Exceedin 64" | Out-File -append aliasexceeding64-03.txt
        }

        $ValidAlias=RegexSearchAndReplace $alias
        $ValidAlias
        if($ValidAlias -eq "No Change")
        {
            write-progress -activity "Checking the PublicFolders " -status "No Change needed:PF(alias) : $alias"
        }
        else
        {
            write-progress -activity "Checking the PublicFolders " -status "Spechial char found:PF(alias) : $alias"
            "$($Folder.identity)#$($alias)#$($ValidAlias)" | out-file -append aliasChange.txt
        }
    "Finished working on $($Folder.identity)"
    "-------------------------------------------"
}

The next step is to change the alias based on the file from the previous step

"Importing the public folders to the memory"
$listOfPublicFolders=import-csv aliasChange.txt -Delimiter "#"
foreach($Folder in $listOfPublicFolders)
{
        "Start working on $($Folder.oldalias)"
        $OldAlias=$Folder.OldAlias
        $Newalias=$Folder.ValidAlias
        write-progress -activity "Change the Alias " -status "Currently processing the PF(alias) : $Folder.OldAlias"
        $PFFolder=Get-MailPublicFolder $OldAlias
        "Found the folder $($PFFolder.alias)"
        $Error.Clear()
        $PFFolder | set-MailPublicFolder -alias $($NewAlias) -ea silentlycontinue -EmailAddressPolicyEnabled:$false
        $Error[0].Exception
        Switch -wildcard ($Error[0].Exception)
        {
        "*The primary SMTP address*" {$Error.Clear();Write-Warning "Wrong SMTP $($Error[0].Exception)"}
        "*The value can't contain leading or trailing whitespace*" {$Error.Clear();Write-Warning "Found Spaces $($PFFolder.name)"; $PFFolder | Set-PublicFolder -Name $PFFolder.Name.tostring().trim();set-MailPublicFolder -identity $($Folder.Identity) -alias $($NewAlias) -ea silentlycontinue -EmailAddressPolicyEnabled:$false}
        Default {"$($OldAlias)#$($Error[0].Exception)"}
        }

"Finished working on $($Folder.identity)"
"-------------------------------------------"
}

We didn’t finish yet

Public folder migration will surprise you with a new error Fatal error TooManyLargeItemsPermanentException has occurred.

The bottom line for this issue is to change the maxSendSize to a higher number, but the question is how to know this number.

The migration report will report all large items so you can check them and found the large item size.

The other option is to generate a report will all items in the public folders and check the largest message size

Get-PublicFolder –recurse –resultsize unlimited | get-publicfolderitemstatistics | select subject,publicfoldername,messagesize

Mail Enabled Public Folders In A Hybrid Deployment: A Sad Story

A.Ashour — Tue, 13 Jan 2015 02:03:46 GMT

The scenario that I will discuss today is not really a fancy one.

The story began with exchange on premise and a hybrid deployment where public folders are migrated to the Office365, 90% of users are migrated to the cloud.

The main question is how to make the mail enabled public folders appear in the on premise GAL and on the office365 GAL.

We already know that DirSync process won’t synchronize mail enabled public folders from the cloud to the on premise environment, that’s a fact.

The only options is to create a mail enabled contact in the on premise environment et voila

Sounds quick easy and achievable BUT real life will carry more complicity with other staffs like distribution groups.

In our scenario all distribution Groups were created originally in the on premise and are synched to the cloud, let’s call them Cloud Groups.

The issue here is that you can’t add cloud folders directly to the group because the group was originally created in the on premise

If we try to add the mail contact to the on premise group, the contact will appear to the on premise users but will never appear as a member to the cloud users.

Ouch, what shall we do then?

I would think of two options however I won’t say I like any of them but those are what we have unfortunately:

1- Mirror the distribution Groups using a script and keep evaluating the membership.

2- Recreate all the distribution groups in the office365 as 90% of users are already in cloud.

In this article we will cover the second option unfortunately

There are many things to cover here:

1- Handle email addresses + LegacyExchangeDN(X500)

2- Handle Multi Value attributes and convert them from distinguishedName to Email address

2.a GrantSendOnBehalfTo

2.b ManagedBy

2.c ModeratedBy

2.d AcceptMessagesOnlyFromSendersOrMembers

2.e BypassModerationFromSendersOrMembers

2.f RejectMessagesFromSendersOrMembers

3- Handle SendAs and SendOnBehalf permissions

4- Handle group membership

5- Handle single value attributes that can be set in the Office365

They are defined in the script in the array $Listofsingleprops

I skipped some properties that can’t be changed in office365 like "MaxSendSize","MaxReceiveSize"

As the process is a bit complex, I decided to split it into several stages so that it’s also possible to use

the same process to recreate distribution groups in a different forest.

Stage 0: One time configuration

1- Create a new OU in active directory “NoDirSync”

2- Exclude this OU form the DirSync configuration

Stage1: Preparation

I developed a script to export all the desired informed to a csv file, the prepare-DGToOffice365.ps1 script.

1- This script will export the following attributes in addition to the group membership and the sendAs permission

$listOfprops=@("SamAccountName","EmailAddresses","ManagedBy","AcceptMessagesOnlyFrom","AcceptMessagesOnlyFromDLMembers",

"AcceptMessagesOnlyFromSendersOrMembers","BypassModerationFromSendersOrMembers",

"ModeratedBy","RejectMessagesFrom","RejectMessagesFromDLMembers",

"RejectMessagesFromSendersOrMembers","GrantSendOnBehalfTo","BypassNestedModerationEnabled",

"MemberJoinRestriction","MemberDepartRestriction","ReportToManagerEnabled",

"ReportToOriginatorEnabled","SendOofMessageToOriginatorEnabled","HiddenFromAddressListsEnabled",

"ModerationEnabled","RequireSenderAuthenticationEnabled","SendModerationNotifications","Alias",

"CustomAttribute1","CustomAttribute10","CustomAttribute11","CustomAttribute12",

"CustomAttribute13","CustomAttribute14","CustomAttribute15","CustomAttribute2",

"CustomAttribute3","CustomAttribute4","CustomAttribute5","CustomAttribute6","CustomAttribute7",

"CustomAttribute8","CustomAttribute9","DisplayName","MaxSendSize",

"MaxReceiveSize","PrimarySmtpAddress","SimpleDisplayName","MailTip")

<#
.SYNOPSIS
Use the Prepare-DGToOffice365.ps1 script to export the distribution groups information to csv file

.DESCRIPTION
    The ultimate objective is to delete all distribution groups from exchange on-premise and create them in the Office365 cloud.
    This sample script is the 1st script to export the distribution groups information from exchange on-premise

.NOTES
    Author       :      Ahmed Ashour - ahmed.ashour@hotmail.fr
    Creation Date:         v1.0 4 Jan 2015
    Last Update :      -----------------
# DISCLAIMER:
# THIS CODE IS SAMPLE CODE. THESE SAMPLES ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.
# MICROSOFT FURTHER DISCLAIMS ALL IMPLIED WARRANTIES INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR OF FITNESS FOR
# A PARTICULAR PURPOSE. THE ENTIRE RISK ARISING OUT OF THE USE OR PERFORMANCE OF THE SAMPLES REMAINS WITH YOU. IN NO EVENT SHALL
# MICROSOFT OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF BUSINESS PROFITS,
# BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, OR OTHER PECUNIARY LOSS) ARISING OUT OF THE USE OF OR INABILITY TO USE THE
# SAMPLES, EVEN IF MICROSOFT HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. BECAUSE SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION
# OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, THE ABOVE LIMITATION MAY NOT APPLY TO YOU.

.PARAMETER GroupName
If the group name is not specified the script will export all the informations for all distribution groups

.PARAMETER OrganizationUnit
You need to specify the NoDirSyn Organization unit that on premise distribution groups will be temporary moved to in order to stop the dirsync for those groups

.PARAMETER Verbose
Enabled verbose logging

.Example

.\Prepare-DGToOffice365.ps1 -OrganizationUnit NoDirSync
This will export the information for all distribution group and move them all to the NoDirSync organization unit

.\Prepare-DGToOffice365.ps1 -GroupName "testDG01"
This will export the information for the group testdg01 and move it to the NoDirSync organization unit

.\Prepare-DGToOffice365.ps1 -GroupName "testDG01" -verbose
This will export the information for the group testdg01, move it to the NoDirSync organization unit and enable verbose logging

.OUTPUTS
Results will be saved to export.csv
Errors will be saved to errors.txt

[CmdletBinding(SupportsShouldProcess=$true)]
Param(
[parameter(mandatory=$false)]$GroupName,
[parameter(mandatory=$True)]$OrganizationUnit
)
$ExportArray=@()
$ValueToStr=""
$DateStamp = Get-Date -f "hh:mm-dd-MM-yyyy"
import-module activedirectory
#Change the following line to search for all groups or a specific group
if($GroupName)
{
$ListOfGroups=get-distributiongroup -identity $GroupName -ResultSize unlimited
}
else
{
$ListOfGroups=get-distributiongroup -ResultSize unlimited
}

"-------------------------Start: Prepare-DGToOffice365 Script $($DateStamp)--------------------------------" | out-file -append errors.txt
if($ListOfGroups)
{
    Foreach($Group in $ListOfGroups)
    {
        "processing $($Group)"

        $listOfprops=@("SamAccountName","EmailAddresses","ManagedBy","AcceptMessagesOnlyFrom","AcceptMessagesOnlyFromDLMembers","AcceptMessagesOnlyFromSendersOrMembers","BypassModerationFromSendersOrMembers","ModeratedBy","RejectMessagesFrom","RejectMessagesFromDLMembers","RejectMessagesFromSendersOrMembers","GrantSendOnBehalfTo","BypassNestedModerationEnabled","MemberJoinRestriction","MemberDepartRestriction","ReportToManagerEnabled","ReportToOriginatorEnabled","SendOofMessageToOriginatorEnabled","HiddenFromAddressListsEnabled","ModerationEnabled","RequireSenderAuthenticationEnabled","SendModerationNotifications","Alias","CustomAttribute1","CustomAttribute10","CustomAttribute11","CustomAttribute12","CustomAttribute13","CustomAttribute14","CustomAttribute15","CustomAttribute2","CustomAttribute3","CustomAttribute4","CustomAttribute5","CustomAttribute6","CustomAttribute7","CustomAttribute8","CustomAttribute9","DisplayName","MaxSendSize","MaxReceiveSize","PrimarySmtpAddress","SimpleDisplayName","MailTip")
        $ListOfsingleprops=@("SamAccountName","BypassNestedModerationEnabled","MemberJoinRestriction","MemberDepartRestriction","ReportToManagerEnabled","ReportToOriginatorEnabled","SendOofMessageToOriginatorEnabled","Alias","CustomAttribute1","CustomAttribute10","CustomAttribute11","CustomAttribute12","CustomAttribute13","CustomAttribute14","CustomAttribute15","CustomAttribute2","CustomAttribute3","CustomAttribute4","CustomAttribute5","CustomAttribute6","CustomAttribute7","CustomAttribute8","CustomAttribute9","DisplayName","HiddenFromAddressListsEnabled","MaxSendSize","MaxReceiveSize","ModerationEnabled","PrimarySmtpAddress","RequireSenderAuthenticationEnabled","SimpleDisplayName","SendModerationNotifications","MailTip")
        $GroupToStr = New-Object PSObject
        $GroupToStr | Add-Member NoteProperty -Name "Name" -Value $Group.Name

        #1-Handle Members
        Write-Verbose "processing membership"
        $listOfMembers=(Get-DistributionGroupMember -Identity $Group.DisplayName | where{$_.recipienttype -eq "UserMailbox" -or $_.recipientType -eq "MailUniversalDistributionGroup"}) #Flash:only mailbox + Groups
        if($listOfMembers)
        {
            foreach($Member in $listOfMembers)
            {
                $ValueToStr=$ValueToStr+";"+(Get-recipient $Member.DistinguishedName).PrimarySmtpAddress.tostring()
                $ValueToStr=$ValueToStr.trimstart(";")
            }
        }
        else
        {
            write-warning "No members"
            $ValueToStr="Null"
        }
        $GroupToStr | Add-Member NoteProperty -Name "Members" -Value $ValueToStr

        ######################Handle Properties#################################
        Foreach($prop in $Listofprops)
        {

write-verbose "processing $($prop)"
$ValueToStr=""

            if([string]::IsNullOrEmpty($group.$($prop)))
            {
                write-warning "Null value for $($prop)"
                $ValueToStr="Null"

            }
            else
            {

                Switch($prop)
                {
                    #2-Handle email addresses & X500
                    EmailAddresses {
                                        write-verbose "processing email addresses"
                                        $ProxyAddresses=$Group.EmailAddresses -split ";"
                                        $X500Address="X500:"+"$($Group.LegacyExchangeDN)"
                                        $ProxyAddresses+=$X500Address
                                        $ValueToStr=""
                                        Foreach($Address in $ProxyAddresses)
                                        {
                                            $ValueToStr=$ValueToStr+";"+$Address
                                            $ValueToStr=$ValueToStr.trimstart(";")
                                        }
                                    }

#3-Handle Single-Values
{$ListOfsingleprops -icontains $prop} {write-verbose "single prop $($prop)";$ValueToStr=$Group.$($prop)}

                    #4-Handle Multi-Values
                    Default {
                                write-verbose "Found Multi $($prop)"
                                $ValueToStr=""
                                foreach($AdMember in $Group.$($prop))
                                {
                                    $ValueToStr=$ValueToStr+";"+(Get-recipient $AdMember.DistinguishedName).PrimarySmtpAddress.tostring()
                                    $ValueToStr=$ValueToStr.trimstart(";")
                                }
                            }
                }

            }

            #5-Populate the PSObject properties
            $GroupToStr | Add-Member NoteProperty -Name $prop -Value $ValueToStr
        }

        #6-Handle SendAs permission
        Write-Verbose "prcoessing sendAs permisisons"
        [String]$ValueToStr=""
        $ListOfPermissions=$group| Get-ADPermission | where{($_.Isinherited -eq $false) -and ($_.extendedrights -like "*Send-As*")}
        if($ListOfPermissions)
        {
            Foreach($Assignee in $ListOfPermissions)
            {
                $ValueToStr=$ValueToStr+";"+(Get-recipient $Assignee.User.ToString()).PrimarySmtpAddress.tostring()
            }
        $ValueToStr=$ValueToStr.trimstart(";")
        $GroupToStr | Add-Member NoteProperty -Name "sendAs" -Value $ValueToStr
        }

        #7-Add Group to the export array
        $ExportArray += $GroupToStr
        "Finsihed $($Group)"

        #8-Move the Group to the NoDirSync OU
        Write-Verbose "Moving the Group to the $($OrganizationUnit)"
        $NoDirSyncOU=Get-OrganizationalUnit $OrganizationUnit
        if($NoDirSyncOU)
        {
            Move-ADObject $Group.DistinguishedName -TargetPath $NoDirSyncOU.DistinguishedName
        }
        else
        {
            "$($Group)#Move#Couldn't find the NoDirSync $($OrganizationUnit)"| out-file -append errors.txt
        }
         "Finished processing $($Group.Name)"
        "--------------------------------------------------------"
    }
#8-export all groups to csv file
$ExportArray|export-csv export.csv
}
"--------------------Finish: Prepare-DGToOffice365 Script ---------------------------------------------------" | out-file -append errors.txt

2- If you didn’t specify a group name when you run the script, this script will search for all distribution groups

3- After the script completes, the group will be moved to the NoDirSync OU.

4- The script will save any errors to errors.txt file

Stage2: Validation:

1- Run DirSync process

2- Check Office365 and make sure that the group is no more available in Office365

Stage3: Creation

1- From Azure PowerShell module, you can run the second script .\Create-DGToOffice365.ps1 –verbose

<#
.SYNOPSIS
Use the Create-DGToOffice365.ps1 script to create the distribution groups in Office365 based on a csv file

.DESCRIPTION
    The ultimate objective is to delete all distribution groups from exchange on-premise and create them in the Office365 cloud.
    This sample script is the 1st script to create the distribution groups was previously removed from exchange on premise into Office365.

.PARAMETER Verbose
Enabled verbose logging

.Example

.\Create-DGToOffice365.ps1
This will create the distribution groups based on the csv file.

.\Create-DGToOffice365.ps1 -verbose
This will create the distribution groupsbased on the csv file and enable verbose logging

.Inputs
Script will require a csv file with all the attributes
Name Members SamAccountName EmailAddresses ManagedBy AcceptMessagesOnlyFrom AcceptMessagesOnlyFromDLMembers AcceptMessagesOnlyFromSendersOrMembers BypassModerationFromSendersOrMembers ModeratedBy RejectMessagesFrom RejectMessagesFromDLMembers RejectMessagesFromSendersOrMembers GrantSendOnBehalfTo BypassNestedModerationEnabled MemberJoinRestriction MemberDepartRestriction ReportToManagerEnabled ReportToOriginatorEnabled SendOofMessageToOriginatorEnabled HiddenFromAddressListsEnabled ModerationEnabled RequireSenderAuthenticationEnabled SendModerationNotifications Alias CustomAttribute1 CustomAttribute10 CustomAttribute11 CustomAttribute12 CustomAttribute13 CustomAttribute14 CustomAttribute15 CustomAttribute2 CustomAttribute3 CustomAttribute4 CustomAttribute5 CustomAttribute6 CustomAttribute7 CustomAttribute8 CustomAttribute9 DisplayName MaxSendSize MaxReceiveSize PrimarySmtpAddress SimpleDisplayName MailTip sendAs

.OUTPUTS
Errors will be saved to errors.txt
#>

[CmdletBinding(SupportsShouldProcess=$true)]
Param()

#Function to open the import csv file
Function Get-FileName($initialDirectory)
{
[System.Reflection.Assembly]::LoadWithPartialName("System.windows.forms") |
Out-Null

$OpenFileDialog = New-Object System.Windows.Forms.OpenFileDialog
$OpenFileDialog.initialDirectory = $initialDirectory
$OpenFileDialog.filter = "All files (*.*)| *.*"
$OpenFileDialog.ShowDialog() | Out-Null
return $OpenFileDialog.filename
}
$ImportFile=Get-FileName -initialDirectory "c:\"

#Function to connect to Office365
Function New-O365ExchangeSession()
{
param([parameter(mandatory=$true)]$365master)

#close any old remote session
Get-PSSession | Remove-PSSession -Confirm:$false

#start a new office 365 remote session
$365session = New-PSSession -ConfigurationName "Microsoft.Exchange" -ConnectionUri 'https://ps.outlook.com/powershell' -Credential $365master -Authentication Basic -AllowRedirection
$office365 = Import-PSSession $365session -AllowClobber

}
$365master = get-credential ashour@myelephantdev.onmicrosoft.com
New-O365ExchangeSession $365master

Function DoYExist()
{
param(
[array]$RecordList,
$Operation,
$ParentGroup
)
    $ValidValueToStr=@()
    Foreach($Record in $RecordList)
    {
        if(Get-Recipient $Record | where{$_.RecipientType -eq "UserMailbox" -or $_.RecipientType -eq "MailUniversalDistributionGroup"})
        {
            write-verbose "Found $($Record)"
            $ValidValueToStr+=$Record
        }
        else
        {
            Write-Verbose "wrong user$($Record)"
            "$($ParentGroup)#$($Operation)#$($Record)#invalid User or Group" | out-file -append errors.txt
        }
    }
    return ,$ValidValueToStr
}

#Load CSV File
$DateStamp = Get-Date -f "dd-MM-yyyy"
$ListOfGroups=import-csv $ImportFile
"-------------------------Start: Create-DGToOffice365 Script $($DateStamp)--------------------------------" | out-file -append errors.txt
if($ListOfGroups)
{
    ForEach($Group in $ListOfGroups)
    {
        "Processing $($Group.name)"
        If(Get-DistributionGroup $Group.Name)
        {
            #1a-Group is available, exit
            Write-Verbose "$($Group.Name) already exist"
        }
        else
        {
            write-verbose "Creating Group $($Group.Name)"
            #1-Create the Group
            $Error.Clear()
            New-DistributionGroup -Name $Group.Name -DisplayName $Group.displayName -PrimarySmtpAddress $Group.PrimarySmtpAddress -Alias $Group.alias
            If ($Error) {"$($Group.displayName)#Creation#$($Error[0].Exception)" | out-file -Append errors.txt}
        }

        "Finished processing $($Group.Name)"
        "--------------------------------------------------------"
    }
}
else
{
    "No entries in the csv file" | out-file -append errors.txt
}
"--------------------Finish: Create-DGToOffice365 Script---------------------------------------------------" | out-file -append errors.txt

2- The script will ask you to provide the csv file will be used to create the distribution groups in office365

Stage4:Update

1- After all the distribution groups are created in Office365, it’s now possible to update all the properties that have group to group relations

2- From Azure PowerShell module, you can run the script .\Update-DGToOffice365.ps1 –verbose

<#
.SYNOPSIS
Use the Update-DGToOffice365.ps1 script to update the distribution groups attributes from a csv file

.DESCRIPTION
    The ultimate objective is to delete all distribution groups from exchange on-premise and create them in the Office365 cloud.
    This sample script is the 3rd script to update the distribution groups created on Office365 with the old information exported from exchange on-premise

.NOTES
    Author       :      Ahmed Ashour - ahmed.ashour@hotmail.fr
    Creation Date:         v1.0 4 Jan 2015
    Last Update :      -----------------

.PARAMETER Verbose
Enabled verbose logging

.Example

.\update-DGToOffice365.ps1
This will set all the distribution groups properties based on the csv file.

.\update-DGToOffice365.ps1 -verbose
This will set all the distribution groups properties based on the csv file and enable verbose logging

.OUTPUTS
Errors will be saved to errors.txt
#>

[CmdletBinding(SupportsShouldProcess=$true)]
Param()

#Function to open the import csv file
Function Get-FileName($initialDirectory)
{
[System.Reflection.Assembly]::LoadWithPartialName("System.windows.forms") |
Out-Null

#Function to connect to Office365
Function New-O365ExchangeSession()
{
param([parameter(mandatory=$true)]$365master)

#close any old remote session
Get-PSSession | Remove-PSSession -Confirm:$false

    #start a new office 365 remote session
    $365session = New-PSSession -ConfigurationName "Microsoft.Exchange" -ConnectionUri 'https://ps.outlook.com/powershell' -Credential $365master -Authentication Basic -AllowRedirection
    $office365 = Import-PSSession $365session -AllowClobber
}
$365master = get-credential #ashour@myelephantdev.onmicrosoft.com
New-O365ExchangeSession $365master

#Function DoIExist
Function DoYExist()
{
param(
[array]$RecordList,
$Operation,
[String]$ParentGroup,
[Parameter(Mandatory=$True)][string]$ImportFile
)
    $ValidValueToStr=@()
    Foreach($Record in $RecordList)
    {
        if(Get-Recipient $Record -erroraction "silentlycontinue"| where{$_.RecipientType -eq "UserMailbox" -or $_.RecipientType -eq "MailUniversalDistributionGroup"})
        {
            write-verbose "Found $($Record)"
            $ValidValueToStr+=$Record
        }
        else
        {
            Write-Verbose "wrong user$($Record)"
            "$($ParentGroup)#$($Operation)#$($Record)#invalid User or Group" | out-file -append errors.txt
        }
    }
    return ,$ValidValueToStr
}

#Load CSV File
$ValueToArray=""
$DateStamp = Get-Date -f "hh:mm-dd-MM-yyyy"
$ListOfGroups=import-csv $ImportFile
"-------------------------Start: Update-DGToOffice365 Script $($DateStamp)--------------------------------" | out-file -append errors.txt
if($ListOfGroups)
{
    ForEach($Group in $ListOfGroups)
    {
        "Processing $($Group.name)"
        If(Get-DistributionGroup $Group.Name -erroraction silentlycontinue)
        {
            Write-Verbose "Found $($Group.Name)"

            #1-Add X500 and smtp addresses
            write-verbose "Email addresses $($Group.Name)"
            $ValueToArray=@($Group.EmailAddresses.split(";"))
            $Error.Clear()
            Set-DistributionGroup -Identity $Group.Name -EmailAddresses $ValueToArray
            If ($Error) {"$($Group.displayName)#Email Addresses#$($Error[0].Exception)" | out-file -Append errors.txt}

            #2-Processing single value attribues
            Write-Verbose "Processing Single Value attributes"
            $ListOfSplat=@{}
            #"MaxSendSize","MaxReceiveSize" are valid for onpremise but are not available for office365 set-distributingroup command
            $Listofsingleprops=@("BypassNestedModerationEnabled","MemberJoinRestriction","MemberDepartRestriction","ReportToManagerEnabled","ReportToOriginatorEnabled","SendOofMessageToOriginatorEnabled","HiddenFromAddressListsEnabled","ModerationEnabled","RequireSenderAuthenticationEnabled","SendModerationNotifications","CustomAttribute1","CustomAttribute10","CustomAttribute11","CustomAttribute12","CustomAttribute13","CustomAttribute14","CustomAttribute15","CustomAttribute2","CustomAttribute3","CustomAttribute4","CustomAttribute5","CustomAttribute6","CustomAttribute7","CustomAttribute8","CustomAttribute9","DisplayName","Alias","PrimarySmtpAddress","SimpleDisplayName","MailTip")
            Foreach($Kei in $Listofsingleprops)
            {
                if($Group.$($kei) -eq "Null")
                {
                    write-verbose "Skip $($kei)"
                }
                else
                {
                    Switch($Group.$($kei))
                    {
                        True {$Kval=$True}
                        False {$Kval=$False}
                        Default{$Kval=$Group.$($kei)}
                    }
                    $ListOfSplat.Add($kei,$Kval)
                }
            }

            $Error.Clear()
            Set-distributiongroup -identity $Group.Name @ListOfSplat
            If ($Error) {"$($Group.displayName)#SingleProps#$($Error[0].Exception)" | out-file -Append errors.txt}

            #3- Processing MultiValue attributes "GrantSendOnBehalfTo","ManagedBy","ModeratedBy","AcceptMessagesOnlyFromSendersOrMembers","BypassModerationFromSendersOrMembers","RejectMessagesFromSendersOrMembers"
            Write-Verbose "Processing Multi Value attributes"
            $ListOfMultiProps=@("GrantSendOnBehalfTo","ManagedBy","ModeratedBy","AcceptMessagesOnlyFromSendersOrMembers","BypassModerationFromSendersOrMembers","RejectMessagesFromSendersOrMembers")
            Foreach($Prop in $ListOfMultiProps)
            {
                Write-Verbose "processing $($prop)"
                $ValueToArray=$Group.$($prop).split(";") | unique
                $ValidValueToStr=(DoYExist $ValueToArray $prop $($Group.displayName))
                if($ValidValueToStr)
                {
                    $HashSplat=@{}
                    $HashSplat.Add($prop,$ValidValueToStr)
                    $Error.Clear()
                    Set-DistributionGroup -Identity $($group.name) @HashSplat
                    If ($Error) {"$($Group.displayName)#$($prop)#$($Error[0].Exception)" | out-file -Append errors.txt}
                }
            }

            #4-Process MemberOf
            write-verbose "Processing MemberOf $($Group.Name)"
            if(!$Group.Members -eq "Null")
            {
                $ValueToArray=$Group.members.split(";") | unique
                $ValidValueToStr=(DoYExist $ValueToArray "Members" $($Group.displayName))
                Foreach($GroupMember in $ValidValueToStr)
                {
                    write-verbose "adding the member $($GroupMember)"
                    $Error.Clear()
                    Add-DistributionGroupMember -Identity $Group.Name -Member $GroupMember
                    If ($Error) {"$($Group.displayName)#Memberof#$($Error[0].Exception)" | out-file -Append errors.txt}
                }
            }
            #4-Process sendAs permission
            write-verbose "Processing the sendAs $($Group.Name)"
            $ListOfTrustee=$Group.SendAs.split(";") | unique
            If($ListOfTrustee)
            {
                Foreach($Trustee in $ListOfTrustee)
                {
                    #Cloud only Add-RecipientPermission $Group.Name -AccessRights SendAs -Trustee $Trustee -Confirm:$false
                    #On-Premise only Add-Adpermission $Group.Name -ExtendedRights Send-As -user $Trustee -Confirm:$false
                    $Error.Clear()
                    Write-Verbose "processing $($Trustee)"
                    Add-RecipientPermission $Group.Name -AccessRights SendAs -Trustee $Trustee -Confirm:$false
                    If ($Error) {"$($Group.displayName)#SendAs#$($Trustee)#$($Error[0].Exception)" | out-file -Append errors.txt}
                }
            }
        }
        else
        {
            Write-Verbose "$($Group.Name) doesn't exist"
            "$($Group.displayName)#Search for the Group#Doesn't Exist" | out-file -Append errors.txt
        }
        "Finished processing $($Group.Name)"
        "--------------------------------------------------------"
    }
}
else
{
    "No entries in the csv file" | out-file -append errors.txt
}
"--------------------Finish: update-DGToOffice365 Script ---------------------------------------------------" | out-file -append errors.txt

3- The script will ask you to provide the csv file will be used to create the distribution group in office365

4- The script will save any errors to errors.txt file

Stage5:Cleanup

Once you feel everything is working fine you can connect to active directory and remove all groups in the NoDirSync OU.

Enjoy

# THIS CODE IS SAMPLE CODE. THESE SAMPLES ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.
# MICROSOFT FURTHER DISCLAIMS ALL IMPLIED WARRANTIES INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR OF FITNESS FOR
# A PARTICULAR PURPOSE. THE ENTIRE RISK ARISING OUT OF THE USE OR PERFORMANCE OF THE SAMPLES REMAINS WITH YOU. IN NO EVENT SHALL
# MICROSOFT OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF BUSINESS PROFITS,
# BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, OR OTHER PECUNIARY LOSS) ARISING OUT OF THE USE OF OR INABILITY TO USE THE
# SAMPLES, EVEN IF MICROSOFT HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. BECAUSE SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION
# OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, THE ABOVE LIMITATION MAY NOT APPLY TO YOU.

Tip of The Day: SkyDrive SPF record

A.Ashour — Mon, 06 Oct 2014 08:56:19 GMT

In a nutshell, if you run hybrid deployment and your MX records are still poining to on premise exchange, you need to update your SPF record to include mail.sharepointonline.com

hmm, why do we need that? Let’s take a flash back.

We are running exchange 2013 on premise environment hybrid with Office 365.

We moved some users to the cloud service but we still keep our MX record pointing to our exchange environment.

Users started to work on OneDrive, formerly SkyDrive, and when they share any document/folder with their colleagues in the cloud/exchange on premise they immediately receive a non delivery report

Unable to send Auto-Generate emails - Undeliverable

Delivery has failed to these recipients or groups:

cloud-02@myeagle.dev

A communication failure occurred during the delivery of this message. Please try to resend the message later. If the problem continues, contact your helpdesk.

Diagnostic information for administrators:

Generating server: AM1YL1SMTP003.YLO001.MSOPRD.MSFT.NET

cloud-01@myeagle,dev

Remote Server returned '< #5.5.0 smtp;553 Sender Policy Framework (SPF) fail>'

cloud-02@myeagle.dev

Remote Server returned '< #5.5.0 smtp;553 Sender Policy Framework (SPF) fail>'

Original message headers:

Received: from CFE4311788-024 ([157.55.231.54]) by

AM1YL1SMTP003.YLO001.MSOPRD.MSFT.NET with Microsoft SMTPSVC(7.5.7601.17514);

Looking into the MX record, our example domain is pointing to other mail server rather than Office365

> set q=mx
> myeagle.dev

Non-authoritative answer:
myeagle.dev MX preference = 10, mail exchanger = cluster8a.eu.messagelabs.com
myeagle.dev MX preference = 5, mail exchanger = cluster8.eu.messagelabs.com

cluster8a.eu.messagelabs.com internet address = 216.82.251.230
cluster8a.eu.messagelabs.com internet address = 85.158.139.103

SkyDrive has a built-in SMTP server which helps to send outbound messages (e.g. system notification email, invitation email of shared folder or site).

When a message is sent from SkyDrive, the next hop for routing is determined by MX record lookup.

In current scenario, the MX record of myeagle.dev is pointing to mail gateway of messagelabs.com. That is why the message will be sent to messagelabs.com and sent back to Office 365 if the user in the cloud

MessageLabs check the SPF record to protect the environment from spoofing, so the email is rejected because SPF is setup for hard fail and the SPF record doesn’t include the SkyDrive IPs.

> set q=txt
> myeagle.dev

Non-authoritative answer:
myeagle.dev text =

"v=spf1 a mx include:spf.protection.outlook.com -all"

Digging more in the message header we could see that SkyDrive is sending from am1.mail.sharepointonline.com and that’s the Joshua puzzle we are missing in our SPF.

Submitting host↓↑	Receiving host↓↑
am1yl1smtp003.ylo001.msoprd.msft.net (am1.mail.sharepointonline.com [157.55.231.39])	ZZSDC2PROOF-A1.kering.net
pps.filterd (ZZSDC2PROOF-A1.kering.net [127.0.0.1])	ZZSDC2PROOF-A1.kering.net (8.14.5/8.14.5)
smtp2.pprgroup.net (172.25.66.34)	MyeagleE15.myeagle.dev
MyeagleE15.myeagle.dev	fnacsmtp2.kering.net (172.26.196.72)
fnacsmpt1.kering.net (193.104.231.160)	AM1FFO11FD048.mail.protection.outlook.com (10.174.65.211)
AM1FFO11FD048.protection.gbl (2a01:111:f400:7e00::185)	AM3PR06CA040.outlook.office365.com (2a01:111:e400:882b::30)
AM3PR06CA040.eurprd06.prod.outlook.com (10.141.192.158)	AMSPR06MB054.eurprd06.prod.outlook.com (10.242.82.20)
AMSPR06MB054.eurprd06.prod.outlook.com (10.242.82.20)	DB4PR06MB061.eurprd06.prod.outlook.com (10.242.154.19)

Finally changing SPF record solve the issue

> set q=txt
> myeagle.dev

Non-authoritative answer:
myeagle.dev text =

"v=spf1 a mx include:spf.protection.outlook.com include:mail.sharepointonline.com -all"

Case Solved, Enjoy