• No Federated or Skype Consumer Access (Tag:NoFederationAndPIC )
• Federated Access Only (Tag:FederationOnly )
• Federated and Consumer Access (FederationAndPICDefault)

Get-CsOnlineUser -Filter {
    (SipProxyAddress -like '*@contoso.com') -and `
    (ExternalAccessPolicy -ne 'BlockSkype') -and `
    (Department -like 'Accounting*')
    } | Grant-CsExternalAccessPolicy -PolicyName 'BlockSkype'

# New-SurfaceHubAccount.ps1 - grb - 03/31/2017 - Adds and configures a new Surface Hub account.

# Configuration variables. You need to replace these with whatever makes sense
# for your environment - especially the password!
$SurfaceHubDisplayname = 'Surface Hub 01'
$SurfaceHubAlias = 'SurfaceHub01'
$SurfaceHubPassword = 'Super-Secret1Password!'
$SurfaceHubMobilePolicy = "Surface Hubs"
$AdminAcccount = 'admin@contoso.com'


# Login to all necessary shells
$MSOLCred = Get-Credential -credential $AdminAcccount
#Azure
Import-Module MSOnline
Connect-MsolService -Credential $MSOLCred
#Exchange Online
$ExSession = New-PSSession -ConfigurationName Microsoft.Exchange 
	-ConnectionUri https://outlook.office365.com/powershell-liveid/ `
	-Credential $MSOLCred -Authentication Basic –AllowRedirection
Import-PSSession $ExSession –AllowClobber -Verbose
#Skype for Business Online
Import-Module LyncOnlineConnector
$lyncsession = New-CsOnlineSession –credential $MSOLCred
Import-PSSession $lyncsession –AllowClobber -Verbose


# Additional calculated variables
$SurfaceHubLicense = (Get-MsolAccountSku | ? {$_.AccountSkuID -like "*ENTERPRISEPREMIUM"}).AccountSkuID
$MSOLAccountSKU = Get-MsolAccountSku
$TenantId = $MSOLAccountSKU[0].AccountObjectId.Guid 
$TenantName = ($MSOLAccountSKU[0].AccountName)
$TenantDomain = $TenantName+'.onmicrosoft.com'
$SurfaceHubAccount = $SurfaceHubAlias+'@'+$TenantDomain


# Create mailbox and configure
New-Mailbox -MicrosoftOnlineServicesID $SurfaceHubAccount -Alias $SurfaceHubAlias -Name $SurfaceHubDisplayname 
	-Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString  `
	-String $SurfaceHubPassword -AsPlainText -Force) -ErrorAction SilentlyContinue

New-MobileDeviceMailboxPolicy -Name $SurfaceHubMobilePolicy -PasswordEnabled $false -ErrorAction silentlycontinue
Set-CASMailbox -Identity $SurfaceHubAccount -ActiveSyncMailboxPolicy $SurfaceHubMobilePolicy

Set-CalendarProcessing -Identity $SurfaceHubAccount -AutomateProcessing AutoAccept -AddOrganizerToSubject $false 
	–AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false

Set-CalendarProcessing -Identity $SurfaceHubAccount -AddAdditionalResponse $true `
	-AdditionalResponse "This room is equipped with a Surface Hub"

Set-Msoluser -UserPrincipalName $SurfaceHubAccount -UsageLocation US
Set-MsolUser -UserPrincipalName $SurfaceHubAccount -PasswordNeverExpires $true

# Apply Office 365 License
Set-MsolUserLicense -UserPrincipalName $SurfaceHubAccount -AddLicenses $SurfaceHubLicense `
	-ErrorAction SilentlyContinue

Get-CASMailbox $SurfaceHubAccount | fl Identity,ActiveSyncMailboxPolicy
Get-MsolUser -UserPrincipalName $SurfaceHubAccount | fl DisplayName,UsageLocation

# Skype for Business account and configuration.
$RegistrarPool = (Get-CsOnlineUser -Identity $SurfaceHubAccount).RegistrarPool

Enable-CsMeetingRoom -Identity $SurfaceHubAccount -RegistrarPool $RegistrarPool -SipAddressType EmailAddress
Get-CsMeetingRoom -identity $SurfaceHubAccount | fl DisplayName,IsValid,SipAddress

# Log out of all sessions
Get-PSSession | Remove-PSSession

echo "end of script"

#DkimCnames.ps1 | grb | 9/9/2016
#Pulls CNAME values from tenant, where DKIM is disabled, and puts these into a csv file

#Some basics. Get & format the date. Define where we are going to write the log file.
$Date = Get-Date -Format 'yyyyMMddhhmm'
$csvPath = 'C:\temp\DkimCnames-'+$Date+'.csv'
$LogPath = 'C:\temp\DkimCnames-'+$Date+'.log'
Start-Transcript -Path $LogPath

$Configs = Get-DkimSigningConfig | ? {$_.Enabled -eq $false} | sort -Property Domain | Select Domain,Selector1CNAME,Selector2CNAME
$NewConfigs=@()

Foreach ($Config in $Configs) {
 $Config | Add-Member -type NoteProperty -name Selector1Host -value ('selector1._domainkey.'+$Config.Domain)
 $Config | Add-Member -type NoteProperty -name Selector2Host -value ('selector2._domainkey.'+$Config.Domain)
 $NewConfigs += $Config
 }

$NewConfigs | Select Domain,Selector1Host,Selector1CNAME,Selector2Host,Selector2CNAME | Export-Csv -LiteralPath $csvPath -NoTypeInformation
Stop-Transcript

I ran into an interesting quandary when working on a Lync Online deployment. If you just have the normal Active Directory install and DirSync with Office 365, using ADFS for authentication, Lync Online will use your UPN as your SIP address. Fair enough – we’d all expect this. If you’re trying to make life easy on yourself, you’re setting your UPN=Primary SMTP=SIP address. Often this is in the format of firstname.lastname@domainname.com. All this becomes very easy for users to log in and get going.

So what happens when you have something as simple as a name change? The Primary SMTP address and UPN change, but the SIP address stays the same. If you want your primary SMTP address to be different than your UPN, it gets worse. These never match. Oh, I know what you’re thinking. Who cares if your SIP address = Primary SMTP? You’re just looking the person up in Lync, anyway, so the address doesn’t matter. Sure. Until you go federate systems. Then the presence information is completely broken and communications just doesn’t happen. And don’t think you’ll be doing SIP address updates in PowerShell online, either. You’re DirSync’ing the account from your on-premises AD, so this won’t work.

So let’s fix it in the on-premises AD!

The first clue is that Lync Online will use your UPN to make a SIP address. But, if you have a SIP address on-premises, that will sync up just fine. Don’t have the Lync schema extensions in your on-premises AD? Not a problem. We are just going to add a SIP address in your list of proxy addresses from email. DirSync (or AAD Sync) will bring that right up.

Where’s the code? It’s below, and I’ll describe what’s going on here. I’m finding all the remote mailbox objects, starting in an OU. You may not want everyone, but they do need to be in Office 365 for this to work. So we pick just the remote user mailboxes.

I then look though all the proxy addresses of each user, looking for the SIP address. If I find it, I compare it to the primary SMTP address (mail attribute, really). If they are the same, I log it. If they are different, I update the SIP address and log it. If I don’t find a SIP address, I add it and log it.

This turns out to be a very “chatty” script, with all the logging going on. In the future, I may cut the logging if the primary SMTP matches the SIP address. And all this logging gave me the excuse for a good title.

#ProxyAddressFixSIP.ps1 - grb - 2/19/2015

#Adds SIP proxy address if not there, and corrects SIP address if not equal to primary SMTP.

#Variable Setup and Initialization

#==============================

$Date = Get-Date -Format 'yyyyMMdd-HHmm'

#Adjust the log path for a good logging directory

$LogPath = 'D:\provisioning\Lync\logs\ProxyAddressFixSIP-'+$Date+'.log'

Start-Transcript -Path $LogPath

#Change this searchbase to match your own environment

$SearchBase = 'OU=test,DC=contoso,DC=com'

#Main Script

#==============================

echo '----------'

echo "Getting Users"

$users = Get-ADObject -Properties DisplayName,proxyAddresses,mail,msExchRecipientTypeDetails,DistinguishedName -SearchBase $SearchBase -Filter {msExchRecipientTypeDetails -eq '2147483648'} -ResultSetSize 1000000 | sort -Property DisplayName

echo "Got Users"

Foreach ($User in $Users) {

    #Initialize variables and arrays that we'll need.

    $mail = $user.mail

    $ProxyAddresses = $User.proxyAddresses

    $NewProxyAddresses =@()

    $NewSIP = $null

    If ($ProxyAddresses -like 'SIP:*') {

        Foreach ($ProxyAddress in $ProxyAddresses) {

            If ($ProxyAddress -like "SIP:*") {

                If (("SIP:"+$mail) -eq $ProxyAddress) {

                    echo '----------'

                    echo ("SIP = MAIL "+$user.DisplayName)

                    } else {

                        echo '----------'

                        $NewSIP = "SIP:"+$mail

                        echo ("SIP Updated "+$user.DisplayName+" $NewSIP")

                        $NewProxyAddresses += $NewSIP

                        }

                } else {$NewProxyAddresses += $ProxyAddress}

            }

        If ($NewSIP -ne $null) {

            Set-ADObject $user.DistinguishedName -Replace @{proxyAddresses=$NewProxyAddresses} -Verbose

        }

   } else {

        echo '----------'

        $NewSIP = "SIP:"+$mail

        $NewProxyAddresses += $NewSIP

        $NewProxyAddresses += $ProxyAddresses

        echo ("SIP Added "+$user.DisplayName+" $NewSIP")

        Set-ADObject $user.DistinguishedName -Replace @{proxyAddresses=$NewProxyAddresses} -Verbose

        }

    }

echo '----------'

echo 'End of script'

echo '----------'

Stop-Transcript

All this code comes with the normal disclaimers, of course. Try this in a lab, if at all possible. You’re on your own here - there’s no warranty on this. At very least, try this on a test OU as the searchbase. If you use it, please leave a comment.

Here's the script I use for doing backups on mailbox folder permissions:

#Save-FolderPermissions.ps1 - grb - 12/17/2014 - This script takes the user and gets folder permissions for the user, exporting it a CSV file.

#variable setup

#You can save only the permissions for the inbox and subfolders with '/Inbox*', for example.

$StartFolder = '/*'

$SaveDir = 'c:\temp\'

$MailboxCount = 0

#Import CSV of all the SMTP address of each of the mailboxes to get its permissions saved

$Mailboxes = Import-Csv -Path ($savedir+"_FolderPermissionsMailboxes.csv")

Foreach ($Mailbox in $Mailboxes) {

#Define $Permissions as an array

$Permissions=@()

#We are going to get a running count of the mailboxes that we are doing. This can be a slow process, so we'll want a status.

$MailboxCount += 1

echo '======================='

echo ('Gathering Statistics for: '+$mailbox.SMTP)

echo ('Mailbox '+$MailboxCount+ ' of '+$mailboxes.Count+' mailboxes')

#Get the folders for the mailbox

$folders = Get-MailboxFolderStatistics -Identity $mailbox.SMTP | ? {$_.FolderPath -like $startfolder} | Select FolderPath

Foreach ($folder in $folders) {

$FolderID = $mailbox.SMTP+":"+($folder.FolderPath | Foreach-Object {$_ -replace "/", "\"})

$Permission = Get-MailboxFolderPermission $FolderID -ErrorAction SilentlyContinue | Select Identity,user,AccessRights,IsValid

$Permissions += $Permission

}

$Permissions | Export-Csv -Path ($savedir+$mailbox.SMTP+"-FolderPermissions.csv") -NoTypeInformation

}

echo "Completed"

#done

You might be wondering about this line:

$FolderID = $mailbox.SMTP+":"+($folder.FolderPath | Foreach-Object {$_ -replace "/", "\"})

It would be nice if the Get-MailboxStatistics command output the folder in the same format that Get-MailboxFolderPermission used. Yeah, not so much. The above fine fixes the formatting between the two commands.

Remember, also, that we needed a CSV file, right? Heres's what that CSV file look like. It's just SMTP addresses of the mailboxes to be backed up, plus the header.

SMTP

User1@contoso.com

User2@contoso.com

Now we have to be able to do a restore. I have a script for that, too.

#Restore-FolderPermissions.ps1 - grb - 12/22/2014 - This script takes the user and imports folder permissions from a CSV file, restoring them.

#variable setup

$SaveDir = 'c:\temp\'

$MailboxCount = 0

#Import CSV of all the SMTP address of each of the mailboxes to get its permissions restored

$Mailboxes = Import-Csv -Path ($savedir+"_FolderPermissionsMailboxes.csv")

Foreach ($Mailbox in $Mailboxes) {

#Define $Permissions as an array

$Permissions=@()

#We are going to get a running count of the mailboxes that we are doing. This can be a slow process, so we'll want a status.

$MailboxCount += 1

echo '======================='

echo ('Restoring Permissions for: '+$mailbox.SMTP)

echo ('Mailbox '+$MailboxCount+ ' of '+$mailboxes.Count+' mailboxes')

$Permissions = Import-Csv -Path ($savedir+$mailbox.SMTP+"-FolderPermissions.csv")

Foreach ($Permission in $Permissions) {

Set-MailboxFolderPermission $Permission.Identity -AccessRights $Permission.AccessRights -User $Permission.User -ErrorAction SilentlyContinue -WarningAction SilentlyContinue

Add-MailboxFolderPermission $Permission.Identity -AccessRights $Permission.AccessRights -User $Permission.User -ErrorAction SilentlyContinue -WarningAction SilentlyContinue

}

}

echo "Completed"

#done

Why use both the "set" and "add" for the folder permissions? One of the commands will modify permissions and the other adds them if they are removed. Either might be needed, so we try both and just ignore the errors.

$user = 'john.doe@contoso.com'

$userphoto = "C:\Temp\"+$user+".jpg"

Set-UserPhoto -Identity $user -PictureData ([System.IO.File]::ReadAllBytes($userphoto)) -Confirm:$false

(Documentation for Set-UserPhoto is here: https://technet.microsoft.com/en-us/library/jj218694.aspx)

When trying to run this, however, one might run into is an error when trying to upload a >10 kb photo, saying “The remote server returned an error: (413) Request Entity Too Large”. There is a fix for this! In the script that you use to create an Exchange Online Powershell session, make sure that the yellow highlighted section below is added. The normal proxy method won’t work for >10kb files.

$ExSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/?proxymethod=rps -Credential $MSOLCred -Authentication Basic -AllowRedirection

Run the first script again, and it now works great with larger photos!

Do keep in mind that the photos you upload should be 648 pixels by 648 pixels if you want the maximum photo size for Office 365. That size comes from the Lync documentation, which explains how Exchange creates the multiple sizes that get used throughout the system. https://technet.microsoft.com/en-us/library/jj688150.aspx