EXO Voice

Use PowerShell formatting features to your advantage!

Victor Legat — Wed, 23 May 2018 16:49:13 GMT

While troubleshooting customers' cases my colleague Tudor Chirita and I have seen many situations where data collected was incomplete, unreadable/unusable or simple hard to follow. We intend to present you some formatting options that can be used to have a more friendly experience. The most used formatting options are: Format-Table and Format-List. Almost everybody is using them with their aliases: FT and FL

Format-Table

C:\> Get-Mailbox | Format-Table

Name Alias ServerName ProhibitSendQuota ---- ----- ---------- ----------------- user1 user1 db5pr0101mb2040 99 GB (106,300,440,576 bytes) user2 user2 vi1pr0101mb2014 49.5 GB (53,150,220,288 bytes) user3 user3 he1pr0102mb2748 99 GB (106,300,440,576 bytes) user4 user4 db5pr01mb1560 99 GB (106,300,440,576 bytes) .............................................................

If their properties have large text we can adapt format with FT -Wrap -AutoSize

Format-List

C:\> Get-Mailbox Admin | Format-List

........................................ AcceptMessagesOnlyFromSendersOrMembers : {} AddressListMembership : {\Staff GAL, \Mailboxes(VLV), \All Mailboxes(VLV), \All Recipients(VLV)...} AdministrativeUnits : {} Alias : admin ArbitrationMailbox : BypassModerationFromSendersOrMembers : {} OrganizationalUnit : eurpr01a001.prod.outlook.com/Microsoft Exchange Hosted Organizations/vilega.onmicrosoft.com CustomAttribute1 : CustomAttribute10 : CustomAttribute11 : CustomAttribute12 : CustomAttribute13 : CustomAttribute14 : CustomAttribute15 : CustomAttribute2 : CustomAttribute3 : CustomAttribute4 : CustomAttribute5 : CustomAttribute6 : CustomAttribute7 : CustomAttribute8 : CustomAttribute9 : ExtensionCustomAttribute1 : {} ExtensionCustomAttribute2 : {} ExtensionCustomAttribute3 : {} ExtensionCustomAttribute4 : {} ExtensionCustomAttribute5 : {} DisplayName : VictorL EmailAddresses : {SPO:SPO_74020321-9dc9-4a7a-beba-33d0d7b74f03@SPO_e0ef2476-0aff-4b94-a7cb-68dc9a0555b8, smtp:postmaster@it4you.ro, smtp:admin@it4you.ro, smtp:admin@vilega.mail.onmicrosoft.com...} ........................................

As you can see some properties have truncated values. Example: AddressListMembership and EmailAddresses. By default, PowerShell displays only the first 4 values of a property. This setting is stored in a variable called $FormatEnumerationLimit E.g.:

C:\> $FormatEnumerationLimit 4 PowerShell can be configured not to truncate the output by setting this variable to -1. E.g.:

$FormatEnumerationLimit = -1

Another way to see all values of EmailAddresses property is to use Select-Object command with ExpandProperty option:

C:\> Get-Mailbox Admin | Select-Object -ExpandProperty EmailAddresses SPO:SPO_74020321-9dc9-4a7a-beba-33d0d7b74f03@SPO_e0ef2476-0aff-4b94-a7cb-68dc9a0555b8 smtp:postmaster@it4you.ro smtp:admin@it4you.ro smtp:admin@vilega.mail.onmicrosoft.com SIP:admin@vilega.onmicrosoft.com SMTP:admin@vilega.onmicrosoft.com Select-Object can also to used with parameter ExcludeProperty to exclude some properties that could clutter the output. When analyzing Exchange Online migration reports you can get:

$stats = Get-MoveRequestStatistics -IncludeReport -Diagnostic -DiagnosticArgument Verbose $stats | fl The output is large because the properties Report and DiagnosticInfo contain lots of data. If we want to have a fast overview of the output we can exclude those and analyze them later.

$stats | select -ExcludeProperty Report,DiagnosticInfo

Now we can see the status of the migration and other parameters and if needed we can investigate separately the too large properties:

$stats.report.ToString()

When using Format-Table, Format-List or Select-Object we can choose which properties to see by specifying property name or part of the name and wildcard character "*"

C:\> Get-MailboxFolderStatistics admin | FT Name, items*

Name ItemsInFolder ItemsInFolderAndSubfolders ---- ------------- -------------------------- Top of Information Store 1 555 Archive 0 0 Calendar 20 31 Calendar1 0 0 Contacts 5 96 {A9E2BC46-B3A0-4243-B315-60D991004455} 3 3 ...............................................................................

Reading a large output of a CmdLet can be gradually done in PowerShell console (not in ISE) by using "| more" or "Out-Host -Paging" like below:

Get-Command –Command | select name, module | more Get-Command –Command | select name, module | Out-Host -Paging get-help Get-MoveRequestStatistics -full |more get-help Get-MoveRequestStatistics -full |Out-Host -Paging Navigate through result: next page; next line; Quit To get the result straight into the clipboard you can use |clip E.g.:

get-mailbox admin | select ExchangeGUID | clip

Sorting To sort the results you can use "Sort" and the name property you want sort by. Default sorting is done Ascending; if you want to sort descending you have to use "-Descending" parameter.

Get-MailboxFolderStatistics admin |select name,folderpath,foldertype |sort folderpath

Name FolderPath FolderType ---- ---------- ---------- Archive /Archive Archive Calendar /Calendar Calendar Calendar Logging /Calendar Logging CalendarLogging Calendar1 /Calendar/Calendar1 User Created ..................................................................................

Grouping the result The Group-Object cmdlet displays objects in groups based on the value of a specified property. Group-Object returns a table with one row for each property value and a column that displays the number of items with that value.

Get-Mailbox -ResultSize Unlimited |Group-Object RecipientTypeDetails

Count Name Group ----- ---- ----- 23 UserMailbox {admin2, admin3, admin4, cloud1, cloud3, cloud4, cloud5, cloud6,... 6 SharedMailbox {cloud2, journal_mbx, shared1, shared2, shared3, shared4} 1 DiscoveryMailbox {Discovery Search Mailbox} 1 SchedulingMailbox {IT} 2 RoomMailbox {room1, room4}

Show Hidden Parameter (-force) PowerShell cannot define private parameters. These can only be hidden. To see all parameters (including hidden ones) of an object you can use * -force E.g.: Showing all parameters of the last error received in current session of PowerShell vs default view of the error:

$e= $error[0]

$e.Exception | fl The operation couldn't be performed because object 'John Doe' couldn't be found on 'VI1PR01A001DC01.EURPR01A001.prod.outlook.com'.

$e.Exception | fl * -f SerializedRemoteException : Microsoft.Exchange.Configuration.Tasks.ManagementObjectNotFoundException: The operation couldn't be performed because object 'dfadfad' couldn't be found on 'VI1PR01A001DC01.EURPR01A001.prod.outlook.com'. at Microsoft.Exchange.Configuration.Tasks.Task.ThrowError(Exception exception, ErrorCategory errorCategory, Object target, String helpUrl) at Microsoft.Exchange.Configuration.Tasks.GetObjectWithIdentityTaskBase`2.InternalProcessRecord() at Microsoft.Exchange.Configuration.Tasks.GetRecipientObjectTask`2.InternalProcessRecord() at Microsoft.Exchange.Management.RecipientTasks.GetRecipientWithAddressListBase`2.InternalProcessRecord() at Microsoft.Exchange.Configuration.Tasks.Task.b__92_1() at Microsoft.Exchange.Configuration.Tasks.Task.InvokeRetryableFunc(String funcName, Action func, Boolean terminatePipelineIfFailed) SerializedRemoteInvocationInfo : System.Management.Automation.InvocationInfo ErrorRecord : The operation couldn't be performed because object 'John Doe' couldn't be found on 'VI1PR01A001DC01.EURPR01A001.prod.outlook.com'. WasThrownFromThrowStatement : False Message : The operation couldn't be performed because object 'John Doe' couldn't be found on 'VI1PR01A001DC01.EURPR01A001.prod.outlook.com'. Data : {} InnerException : TargetSite : StackTrace : HelpLink : Source : HResult : -2146233087

Exporting When it comes to exporting data in order to either analyze later or do the formatting in another program, there are a few options available:

Export-Clixml - this cmdlet allows a serialized object to be exported instead of just a text file. You can then use the Import-Clixml cmdlet to re-create the saved object based on the contents of that file.

Get-MailboxStatistics -Identity $mailbox -IncludeMoveReport | Export-Clixml C:\temp\Mailbox_statistics.xml $Stats = Import-Clixml C:\temp\Mailbox_statistics.xml

Export-Csv - this cmdlet cmdlet creates a CSV file of the objects that you submit. Each object is represented as a line or row of the CSV.

Note: Do not format objects before sending them to the Export-CSV cmdlet. If you do, the format properties are represented in the CSV file, instead of the properties of the original objects. To export only selected properties of an object, use the Select-Object cmdlet. Notable parameters: -Path: Specifies the path to the CSV output file. -Append: Adds the new script data to the end of the output file, instead of replacing the existing file contents. -Delimiter: Specifies a delimiter to separate the property values. The default is a comma -NoTypeInformation: omits the type information from the CSV file.

By default, PowerShell sends its command output to the PowerShell console. However, you can direct the output to a text file.

Use the Out-File cmdlet, which sends command output to a text file.

$obj | Out-File C:\temp\props.txt

">" Sends output to the specified file.

Get-Process > Process.txt

The Out-GridView cmdlet sends the output from a command to a grid view window where the output is displayed in an interactive table.

Get-Mailbox | Out-GridView

The command uses the PassThru parameter of Out-GridView, which lets you send multiple items down the pipeline. The example below will show all soft deleted mailboxes and let the user select one or more mailbox(es) to recover and store it/them in $MailboxToRecover $MailboxToRecover = Get-Mailbox -SoftDeletedMailbox -ResultSize Unlimited | Out-GridView -PassThru

The Tee-Object cmdlet saves command output in a file or variable and also sends it down the pipeline.

get-mailbox admin | select * | Tee-Object C:\temp\mymbx.txt

Hide Output Sometime could be useful to hide output from being displayed on the screen console. There are multiple ways to accomplish this:

redirect the output to $null

Add-MailboxPermission shared1 -User admin -AccessRights FullAccess > $null

explicit cast the result object to [void]

[void](Add-MailboxPermission shared1 -User admin -AccessRights FullAccess)

The Out-Null cmdlet sends its output to NULL, in effect, removing it from the pipeline and preventing the output to be displayed at the screen.

Add-MailboxPermission shared1 -User admin -AccessRights FullAccess | Out-Null

How to sort properties of a cmdlet Cmdlet properties can also be sorted as desired. In this example, the properties of Get-Mailbox are sorted alphabetically for an easier view.

$obj = get-mailbox user1 $obj |select ($obj |gm |? MemberType -eq Property | sort name).name $obj |select ($obj |gm -MemberType Property| sort name).name $obj | fl -property ($obj| gm | sort name).name $obj | %{ $newobj = new-object psobject; $_.psobject.properties | Sort Name | %{ Add-Member -Inp $newobj NoteProperty $_.Name $_.Value}; $newobj } | fl References: https://docs.microsoft.com/en-us/powershell/scripting/getting-started/cookbooks/using-format-commands-to-change-output-view?view=powershell-6 https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_redirection?view=powershell-6 https://docs.microsoft.com/en-us/powershell/scripting/getting-started/cookbooks/redirecting-data-with-out---cmdlets?view=powershell-6 https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_hidden?view=powershell-6

How to set up IIS to send emails using Office 365

Cristian Nitu — Thu, 17 May 2018 17:07:00 GMT

Sometimes organizations need to set up a multifunction device or application to send email through Office 365 and they discover that the device or application can’t connect directly to Office 365. In these cases, they can to set up Internet Information Services (IIS) to work as an intermediary. Office 365 customers might want to do this in the following scenarios:

The on-premises messaging system no longer exists
The on-premise hardware devices (e.g. scanner, printer, multi-functional printer, etc.) do not support TLS 1.2. (https://support.microsoft.com/en-us/help/4057306/preparing-for-tls-1-2-in-office-365)
The on-premise Line-Of-Business applications (LOB) (e.g. Your resource management, Ticket/order processing, in-house developed applications, other 3rd party applications, etc.) must send email messages to remote domains and to Exchange Online mailboxes
To secure and restrict applications and devices that can relay emails through Office 365
The LOB application or the hardware device does not store any SMTP log needed in compliance or troubleshooting scenarios

When implementing this solution, customers must keep in mind that under no circumstances does Office 365 allows any form of unsolicited marketing/BULK/SPAM emails to be sent from the service. Therefore, we discourage the delivery of unsolicited bulk messages though Office 365 and advise our Customers who need to send legitimate bulk commercial email (for example, customer newsletters) to use third-party providers that specialize in these services. In this article my colleague Alexandru Liviu Nita and I will try to provide guidance on how to choose, deploy and troubleshoot different Relay solutions that can be used with Office 365.

Which solution should you choose

Office 365 currently supports several methods of SMTP Relay and this article will try to help you choose and implement the appropriate one:

Client SMTP Submission: You configure a user, device, or internal line-of-business (LOB) application to send mails as a single SMTP address for a domain you own to Office 365 & Internet recipients
Direct Send: You configure a user, device, or line-of-business (LOB) application to directly send emails to Office 365 recipients
SMTP Relay: You configure a user, device, or line-of-business (LOB) application to send email as multiple senders who may not have Office 365 mailboxes to Office 365 & Internet recipients

	SMTP Client Submission	Direct Send	SMTP Relay
Features
Send to recipients in your domain(s)	Yes	Yes	Yes
Relay to Internet via Office 365	Yes	No. Direct delivery only.	Yes
Bypasses antispam	Yes, if the mail is destined for an Office 365 mailbox.	No. Suspicious emails might be filtered. We recommend a custom Sender Policy Framework (SPF) record.	No. Suspicious emails might be filtered. We recommend a custom SPF record.
Supports mail sent from applications hosted by a third party	Yes	No	No
Requirements
Open network port	Port 587 or port 25	Port 25	Port 25
Office 365 connector required	No	No	Yes
TLS Support	Required	Recommended	Recommended
Requires authentication	Office 365 user name and password required	None	Requires unshared static public IP addresses (unless a certificate is used).
Limitations
Throttling limits	10,000 recipients per day. 30 messages per minute.	Standard throttling is in place to protect Office 365.	Reasonable limits are imposed. The service can't be used to send spam or bulk mail. For more information about reasonable limits, see High-risk delivery pool for outbound messages.

Which changes you need to implement

SMTP Client Submission

This is the recommended method for sending emails through Office 365.

In this implementation, the device or application uses an Exchange Online account to send email to (Office 365 and Internet) recipients just like an email client.

The sending address must also be either an Exchange Online-licensed user in Office 365 or an alternative email address of an Exchange Online-licensed user. For example, if the address that is used for sending from is printer@tailspintoys.com and the account that is used to relay through is myapps@yourdomain.com (an Office 365 user), then printer@tailspintoys.com must be an alternate email address to myapps@yourdomain.com.

Starting June 1^st2018, the following changes will begin rolling out for SMTP Authenticated Submission protocol:

1. Sent email will now be stored in the Sent Items folder of the mailbox.

2. Only three concurrent connections to our service per mailbox will be allowed. Additional connections will be rejected with the error: 4.3.2 STOREDRV.ClientSubmit; sender thread limit exceeded.

https://blogs.technet.microsoft.com/exchange/2018/04/20/changes-coming-to-the-smtp-authenticated-submission-client-protocol/

If the sending email address doesn't match the login credentials, then 'Send As' permissions are required. Using a single mailbox with Send As permissions for all your users is not supported because of complexity and potential issues.

Configuration Changes Required

On-premise

1. Install IIS SMTP server

2. Configure the outbound connection

3. Configure IIS authentication

4. Configure IIS relay restrictions

5. Configure Delivery Settings

Cloud

No configuration needed (if an existing cloud user is used for authentication)

DNS

No configuration needed

Direct Send

This is the simplest method to set up as there is no Office 365 configuration needed.

Use this implementation if the device or application is only sending emails to your own Office 365 users and SMTP Client Submission is not an option.

Direct Send allows each user in the organization to send emails using their own address. So if you want your device or application to send messages from each user’s email address and do not want multiple user credentials to be configured, Direct Sent should be used.

Use Direct Send if your device or application does not meet the requirements of SMTP Client Submission, such as TLS support.

Office 365 does not allow you to send bulk email or newsletters via SMTP Client Submission. Direct Send allows you to send a higher volume of messages. However, there is a risk of your email being marked as spam by Office 365. You might want to enlist the help of a bulk email provider to assist you. There are best practices for bulk email, and bulk email providers can help ensure that your domains and IP addresses are not blocked by others on the Internet.

Make sure the Outbound Public IP is not listed on SpamHaus or Microsoft Internal lists. In case the IP is listed, delist the IP first or use SMTP Client Submission.

Configuration Changes Required

On-premise

1. Install IIS SMTP server

2. Define a remote domain in IIS

3. Configure the domain to allow relay

4. Configure the outbound connection

5. Configure IIS authentication

6. Configure IIS relay restrictions

Cloud

No configuration needed

DNS

The on-premise IP should to be added to the SPF (ex. v=spf1 ip4:10.5.3.2 include:spf.protection.outlook.com –all)

SMTP Relay

SMTP Relay is very similar to Direct Send except that it can be used to send emails also to external recipients

SMTP Relay can’t be used to send email directly to Office 365 from a third-party hosted service, such as Microsoft Azure.

Use this implementation if the device or application will send emails both to internal users and external recipients and SMTP Client Submission is not an option.

You want your device or application to send from each user’s email address and do not want multiple user credentials to be configured. SMTP Relay allow each user in the organization to send email using their own address.

Use SMTP Relay if your device or application does not meet the requirements of SMTP Client Submission, such as TLS support.

Office 365 does not allow you to send bulk email or newsletters via SMTP client submission. SMTP Relay allows you to send a higher volume of messages. However, there is a risk of your email being marked as spam by Office 365. You might want to enlist the help of a bulk email provider to assist you. There are best practices for bulk email, and bulk email providers can help ensure that your domains and IP addresses are not blocked by others on the Internet.

Make sure the Outbound Public IP is not listed on SpamHaus or Microsoft Internal lists. In case the IP is listed, delist the IP first or use SMTP Client Submission.

In case SMTP Relay is configured to use a certificate to send emails through Office 365, the Common-Name (CN) or Subject Alternate Name (SAN) in the certificate should contain a domain name that was registered in Office 365.

https://support.microsoft.com/en-us/help/3169958/important-notice-for-office-365-email-customers-who-have-configured-co

Configuration Changes Required

On-premise

1. Install IIS SMTP server

2. Configure IIS to allow relay

3. Configure the outbound connection

4. Configure IIS authentication

5. Configure IIS relay restrictions

Cloud

Create an Inbound On-Premise Type Connector in Exchange Admin Center to authenticate the mail sent from the device or application(https://technet.microsoft.com/en-us/library/dn751020(v=exchg.150).aspx#Anchor_5)

DNS

The on-premise IP should to be added to the SPF record (ex. v=spf1 ip4:10.5.3.2 include:spf.protection.outlook.com –all)

Which IIS settings you need to configure

SMTP Client Submission

Relay Restrictions

Open IIS 6.0 Manager, right click Default SMTP Virtual Server, and then click Properties.
Click the Access tab, and then click Relay.
In the Select which computers may relay through this virtual server area, click Only the list below, and then enter the IP addresses of the on-premises LOB devices and application servers that will relay through the SMTP server

Change Outbound Port

Click Properties of the SMTP Virtual Server
On the Access tab, click Delivery tab, and Outbound Connections
Change TCP port from 25 to 587

Configure Smart Host

Click the Delivery tab, click Advanced
Under Smart host, enter the fully qualified domain name (FQDN) of the SMTP server of the on-line Exchange mailbox (smtp.office365.com).

Configure Recipient Domain Options

1. Configure IIS with SCS (for all domains)

On the Delivery tab, click Outbound Security
Select Basic Authentication.
In the User name and password boxes enter an Office 365 account (and it’s password)
Select the TLS encryption check box, and then click OK.

2. Configure IIS with SCS (for one domain)

Define a remote domain in IIS:
- In IIS Manager, expand Default SMTP Virtual Server, Domains.
- Right-click Domains, click New, click Domain, and then click Remote.
- In the Name box, type the name of your domain. For example, type yourdomain.com. Then, click Finish

Set the routing settings for yourdomain.com
- Set the routing settings for yourdomain.com
- In IIS Manager, expand Default SMTP Virtual Server, Domains.
- Click Domains, right-click yourdomain.com, and then click Properties.
- Check Allow incoming mail to be relayed to this domain.
- Set smtp.office365.com as the smart host.
- Open Outbound Security and enter an Exchange Online account credentials.
- Check TLS encryption.

SMTP Relay/Direct Send

Configure IIS for relaying

Click the Delivery tab, click Advanced
Under Smart host, enter the SMTP end-point for the tenant domain. This will be the MX endpoint for the Office 365 tenant. (i.e Yourdomain-com.mail.protection.outlook.com)

Configure Relay Restrictions

Open IIS 6.0 Manager, right click Default SMTP Virtual Server, and then click Properties.
Click the Access tab, and then click Relay.
In the Select which computers may relay through this virtual server area, click Only the list below, and then enter the IP addresses of the on-premises LOB devices and application servers that will relay through the SMTP server

Configure Outbound Security

On the Delivery tab, click Outbound Security
Select Anonymous.
Select the TLS encryption check box, and then click OK.

Troubleshoot SMTP Client Submission

Test the user name and password by logging on to Outlook Web App (OWA), and try to send a test email to make sure the account is not blocked

In case “550 5.1.8 Bad outbound sender” error is received, delist the user form the Action Center (https://technet.microsoft.com/en-gb/library/dn458545(v=exchg.150).aspx)

Check TCP Configuration (IP, DNS Server and Gateway) on the IIS Server.
Test Office 365 connectivity from the IIS Server:
- Enable the Telnet Client tool on the IIS Server. (https://social.technet.microsoft.com/wiki/contents/articles/22715.how-to-enable-telnet-in-windows-server-2012.aspx)
- Run the tool from the command line by typing telnet
- Type open smtp.office365.com 587 (or substitute 25 for 587 if that port is instead used).
- If you connected successfully to an Office 365 server, expect to receive a response line similar to this: 220 DB3PR08CA0008.outlook.office365.com Microsoft ESMTP MAIL Service ready at Mon, 18 Apr 2016 06:22:08 +0000
- If the connection is not successful, then the network firewall or Internet Service Provider (ISP) may block port 587 or 25. Correct this to be able send email from IIS
- If the response does not contain ‘outlook.office365.com Microsoft ESMTP MAIL Service’ check firewall configuration
- Type ehlo yourdomain.com and then starttls and check for the following response 220 2.0.0 SMTP server ready
Use PowerShell to send an email:
- Open PowerShell and run $PSVersionTable
- Make sure PSVersion is at least 3.0
- Run the following command and enter the User and the Password used by the IIS: $O365Sender = Get-Credential
- Run the following command to add a recipient: $O365Recipient = Read-Host 'Please type the Email address of the recipient‘
- Depending of the port use run the right command to send an email:

$d=date; Send-mailmessage -to $O365Recipient -from $O365Sender.UserName -smtpserver smtp.office365.com -subject "SMTP - Client submission - 25" -body "This is the body of test message. The message was sent on: $d " -Credential $O365Sender -UseSsl -BodyAsHtml -port 25; write-host "Sending Message...

$d=date; Send-mailmessage -to $O365Recipient -from $O365Sender.UserName -smtpserver smtp.office365.com -subject "SMTP - Client submission - 587" -body "This is the body of test message. The message was sent on: $d " -Credential $O365Sender -UseSsl -BodyAsHtml -port 587; write-host "Sending Message..."

If you want to test with your own content you can use the following commands:

$Path=[Environment]::GetFolderPath("Desktop") $BodyFile = "$Path\content.htm" $File = Get-Content $BodyFile -Encoding UTF8 $Body = $File | Out-String $d=date; Send-mailmessage -to $O365Recipient -from $O365Sender.UserName -smtpserver smtp.office365.com -subject "SMTP - Client submission - 587" -body $([string] $body) -Credential $O365Sender -UseSsl -BodyAsHtml -port 587; write-host "Sending Message..."

Troubleshoot Direct Send

Emails send from the device are marked as junk by Office 365
- Make sure the IP is added to the SPF record
- Check if empty messages are also marked as spam
Emails are not sent to recipients who are not in the same organization
- By design. Use SMTP Relay instead
Test Office 365 connectivity from the network:
- Determine the MX endpoint for the Office 365 tenant, which ends with "mail.protection.outlook.com." (https://support.office.com/en-us/article/Gather-the-information-you-need-to-create-Office-365-DNS-records-77F90D4A-DC7F-4F09-8972-C1B03EA85A67#ID0EAADAAA=Step_2)
- Enable the Telnet Client tool on the IIS Server. (https://social.technet.microsoft.com/wiki/contents/articles/22715.how-to-enable-telnet-in-windows-server-2012.aspx)
- Run the tool from the command line by typing telnet
- Type open yourdomain-com.mail.protection.outlook.com 25 (where yourdomain-com.mail.protection.outlook.com is the MX endpoint determined at the first step)
- If you connected successfully to an Office 365 server, expect to receive a response line similar to this: 220 BN1BFFO11FD038.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 18 Apr 2016 07:36:51 +0000
- If the connection is not successful, then the network firewall or Internet Service Provider (ISP) may block port 25. Correct this to be able send email from IIS Server
- If the response does not contain ‘mail.protection.outlook.com Microsoft ESMTP MAIL Service’ check firewall configuration
- Type the following command: EHLO yourdomain.com, and then press Enter. You should receive the following response:

250-DB3FFO11FD036.mail.protection.outlook.com Hello [IP address]

250-SIZE 157286400

250-PIPELINING

250-DSN

250-ENHANCEDSTATUSCODES

250-STARTTLS

250-8BITMIME

250-BINARYMIME

250 CHUNKING

- Type the following command using the correct sender address: mail from: sender@yourdomain.com, and then press Enter. You should receive the following response: 250 2.1.0 Sender OK
- Type the following command using the correct recipient address: rcpt to: recipient@yourdomain.com, and then press Enter. You should receive the following response: 250 2.1.5 Recipient OK
- In case the following error is generated "5.7.1 Service unavailable, Client host [IP address] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/lookup.lasso (AS16012612)", you need to delist the IP address.
- In case either of the following errors are generated:
  - - 550 5.7.1 Service unavailable; Client host [IP address] blocked using FBLW15; To request removal from this list please forward this message to delist@messaging.microsoft.com
    - 550 5.7.606-649 Access denied, banned sending IP [IP address]; To request removal from this list please visit https://sender.office.com/ and follow the directions. For more information please go to https://go.microsoft.com/fwlink/?LinkID=526653.
    - You will need to delist the IP address from : https://sender.office.com
- In case the following error is generated “550 5.7.64 TenantAttribution; Relay Access Denied” make sure that the recipient is the same organization.
- Type the following command: DATA, and then press Enter. You should receive the following response: 354 Start mail input; end with .
- Type the following command: Subject: Telnet test message and Press Enter two times
- Type a period (.) at the next blank line, and then press Enter. You should receive the following response: 250 OK.
- Confirm with the recipient that the email was received.
If you want to test with your own content you can use the following PowerShell commands:

$Path=[Environment]::GetFolderPath("Desktop") $BodyFile = "$Path\content.htm" $File = Get-Content $BodyFile -Encoding UTF8 $Body = $File | Out-String $O365Sender = Read-Host 'Please type the Email address of the sender‘ $O365Recipient = Read-Host 'Please type the Email address of the recipient‘ $d=date; Send-mailmessage -to $O365Recipient -from $O365Sender -smtpserver yourdomain-com.mail.protection.outlook.com -subject "SMTP - Direct Send - 25" -body $([string] $body) -BodyAsHtml -port 25;write-host "Current date is $d; Sending Message..."

Troubleshoot SMTP Relay

Emails send from the device are marked as junk by Office 365
Make sure the IP is added to the SPF record
Test Office 365 connectivity from the network:
- Determine the MX endpoint for the Office 365 tenant, which ends with "mail.protection.outlook.com." (https://support.office.com/en-us/article/Gather-the-information-you-need-to-create-Office-365-DNS-records-77F90D4A-DC7F-4F09-8972-C1B03EA85A67#ID0EAADAAA=Step_2)
- Enable the Telnet Client tool on the IIS Server. (https://social.technet.microsoft.com/wiki/contents/articles/22715.how-to-enable-telnet-in-windows-server-2012.aspx)
- Run the tool from the command line by typing telnet
- Type open yourdomain-com.mail.protection.outlook.com 25 (where yourdomain-com.mail.protection.outlook.com is the MX endpoint determined at the first step)
- If you connected successfully to an Office 365 server, expect to receive a response line similar to this: 220 BN1BFFO11FD038.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 18 Apr 2016 07:36:51 +0000
- If the connection is not successful, then the network firewall or Internet Service Provider (ISP) might have blocked port 25. Correct this to be able send email from your organization
- If the response does not contain ‘mail.protection.outlook.com Microsoft ESMTP MAIL Service’ check firewall configuration
- Type the following command: EHLO yourdomain.com, and then press Enter. You should receive the following response:

250-DB3FFO11FD036.mail.protection.outlook.com Hello [IP address]

250-SIZE 157286400

250-PIPELINING

250-DSN

250-ENHANCEDSTATUSCODES

250-STARTTLS

250-8BITMIME

250-BINARYMIME

250 CHUNKING

- Type the following command using the correct sender address: mail from: sender@yourdomain.com, and then press Enter. You should receive the following response: 250 2.1.0 Sender OK
- Type the following command using the correct recipient address: rcpt to: recipient@yourdomain.com, and then press Enter. You should receive the following response: 250 2.1.5 Recipient OK
- In case the following error is generated "5.7.1 Service unavailable, Client host [IP address] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/lookup.lasso (AS16012612)", you need to delist the IP address.
- In case either of the following errors are generated:
  - 550 5.7.1 Service unavailable; Client host [IP address] blocked using FBLW15; To request removal from this list please forward this message to delist@messaging.microsoft.com
  - 550 5.7.606-649 Access denied, banned sending IP [IP address]; To request removal from this list please visit https://sender.office.com/ and follow the directions. For more information please go to https://go.microsoft.com/fwlink/?LinkID=526653.
  - You will need to delist the IP address from : https://sender.office.com
- In case the following error is generated “550 5.7.64 TenantAttribution; Relay Access Denied” make sure that the cloud connector has the correct IP(If an IP scoped connector is used). The IP can be seen in the output: “250-DB3FFO11FD036.mail.protection.outlook.com Hello [IP address]
- Type the following command: DATA, and then press Enter. You should receive the following response: 354 Start mail input; end with .
- Type the following command: Subject: Telnet test message and Press Enter two times.
- Type a period (.) at the next blank line, and then press Enter. You should receive the following response: 250 OK.
- Check with the recipient if the email was received.
If you want to test with your own content you can use the following PowerShell commands:

$Path=[Environment]::GetFolderPath("Desktop") $BodyFile = "$Path\content.htm" $File = Get-Content $BodyFile -Encoding UTF8 $Body = $File | Out-String $O365Sender = Read-Host 'Please type the Email address of the sender‘ $O365Recipient = Read-Host 'Please type the Email address of the recipient‘ $d=date; Send-mailmessage -to $O365Recipient -from $O365Sender -smtpserver yourdomain-com.mail.protection.outlook.com -subject "SMTP - SMTP Relay- 25" -body $([string] $body) -BodyAsHtml -port 25;write-host "Current date is $d; Sending Message..."

IIS Specific Troubleshooting

Make sure that IIS uses the correct certificate (in case the inbound connector uses certificate)
- Confirm that only the certificate to be used by the SMTP server is in the Local_Machine\Personal certificates repository. Additional certificates can be added later.
- Confirm that the fully qualified domain name (FQDN) that’s configured under the SMTP Virtual Server properties matches the certificate's subject name.
- Configure the FQDN of the SMTP Virtual Server. Confirm that the certificate is found by the SMTP service. To do this, follow these steps:
  - Locate SMTP Virtual Server Properties.
  - On the Delivery tab, click Advanced, and then type the FQDN in the Fully-qualified domain name box.
  - Restart the SMTP service
- Confirm that the certificate is found by the SMTP service. To do this, follow these steps:
  - Locate SMTP Virtual Server Properties.
  - On the Access tab, the Secure communications section should display the following: A TLS certificate is found with expiration date: day/month/year.
  - Compare the shown date with the actual certificate expiration date.
Enable SMTP Logs:
- Internet Information Service (IIS) Manager. Right click "Default SMTP Virtual Server" and choose "Properties". Check "Enable logging“
- Click "Properties ..." to check all options.
On the IIS server run a telnet test (telnet localhost 25)
Test outbound mail flow with a file in the Pickup folder
- Create the file using a text editor such as Microsoft Notepad, and then type the message information into the file. Example: from:testuser@internaldomain.com to:tbill@externaldomainname.com subject:This is a test. this is a test.
- Save the file without an extension to c:\Inetpub\mailroot\Pickup\ do so in Notepad, insert quotation marks (" ") around the file name, and then save the file. When the file name includes quotation marks, Notepad saves the document as a .txt file by default. The name of the file is irrelevant, you can name the file to suit your needs.
- If the configuration of the SMTP service is correct, the message is delivered to the e-mail address in the "to" line in the .txt file. If the file is stuck in the Queue folder or present in the Badmail folder, there is a problem with the SMTP service configuration.
- Check c:\Inetpub\mailroot\Badmail
  - Emails that could not be delivered to the intended recipient are left in the Badmail folder
  - Common causes of messages ending up in the Badmail folder are incorrect or invalid email addresses and DNS issues
  - Open the .bad file for more details
- Check SMTP Logs
  - Check the SMTP log files at C:\WINDOWS\system32\LogFiles\SMTPSVC1
  - Check for any error on email submission.
This is a simple set of PowerShell commands that may help you, as it will export the IIS logs to a csv file:

$ts = Get-Date -Format yyyyMMdd_hhmmss; $Path=[Environment]::GetFolderPath("Desktop") $StartDate = [DateTime]::Today.AddDays(-1) $EndDate = [DateTime]::now $IISLogsFolder = "C:\Windows\System32\LogFiles\SMTPSVC1" $IISFiles = Get-ChildItem $IISLogsFolder\*.log |Where-Object {($_.CreationTime -gt $StartDate) -and ($_.CreationTime -lt $EndDate)} $IISLogsT1 = Get-Content $IISFiles $IISLogsT2 =$IISLogsT1 | where {$_ -notLike "#[D,S-V]*" } $IISLogsT2[0] = $IISLogsT2[0] -Replace '#Fields: ', '' $IISLogs = $IISLogsT2 | where {$_ -notLike "#[F]*" } $IISLogsOut = $IISLogs | Where {($_ -like "*OutboundConnection*") -or ($_ -like "*computer*")} $IISLogs | ConvertFrom-Csv -Delimiter ' ' |Export-Csv $Path\$ts.IISLogs.csv -NoTypeInformation $IISLogsOut | ConvertFrom-Csv -Delimiter ' ' |Export-Csv $Path\$ts.IISLogs_OutboundConnections.csv -NoTypeInformation

Email Encryption in Office 365

Manuel Alex Pereira — Mon, 14 May 2018 18:25:51 GMT

In current times to be compliant with secure data and access, companies are challenged day by day to the possible threat of information leakage.

And sharing the data, although often necessary for work projects, also needs to be secured.

Encryption is the most effective way to achieve data security. Encryption is the process of encoding a message or information making it restricted for specific people. To read an encrypted file, you must have access to a secret key or password that enables you to decrypt it. In other words, a “permission”. In an IT perspective, data encryption translates data into another form, or code, so that only people with said access can read it. How does this relate to Office 365? Compliance is an on-going process and a shared responsibility. Data Loss can be a loss of a deal to the competition; Leak of the company’s customer data; Internal procedures and or legal related cases; Company user's private data; Etc. And most of the time, it will affect the company negatively in one way or the other. Azure Information Protection (AIP) is cloud service which purpose is to allow an organization to classify, label, and protect its documents and emails in compliance with private data. Rules and conditions can be defined either by an administrator or, users if allowed. Azure Rights Management Services (RMS) is a Microsoft security tool that provides persistent data protection by enforcing data access policies (also known as Templates). Together with encryption, these authorization policies are what allows the cloud-based service to help secure files and emails, working across a variety of devices - phones, tablets, and PCs. Information can be protected even outside an organization because that protection remains attached to data, even when it leaves an organization’s boundaries. As a very simple example:

(…) employees might email a document to a partner company or, save a document to their cloud drive. The persistent protection that Azure RMS provides not only helps to secure your company data, but might also be legally mandated for compliance, legal discovery requirements, or simply for good information management practices. (…)

https://docs.microsoft.com/en-us/azure/information-protection/understand-explore/what-is-azure-rms

Note: Keep in mind that users with access can still take a photo with their cell phones or take notes of the information that they see on their computers, where the file is protected.

AIP protection technology makes use of Azure RMS encryption, access policies and identity. These policies or Templates stay with the documents even when they leave the organization. So, how does it integrate with Exchange? Through Information Rights Management (IRM), which is the RMS enabled Application for Exchange. IRM is the component in the RMS-enabled application that enforces said rights on Exchange Online or SharePoint Online.

In the Beginning…

Rights management started as an add-on to the windows server. On premises, the service has the name of Active Directory Rights Management (or AD RMS for short) and encryption features were allowed for integrate with Exchange Server (2010 onwards), SharePoint and Windows File Server Resource Manager under the name of Information Rights Management (or IRM). At the time, only Office files were supported for the service.

How does it Work

Simply put, a file or email is encrypted by getting a publishing license from the RMS service. When the user accesses their mail client (web or desktop client) and tries to see the RMS Templates, Exchange’s IRM would query RMS which in turn would query the Active Directory to see if the user has permission.

Going to cloud: With the need of service integration, flexibility and remote access, disaster recovery, collaboration (between same or different companies), document control and security (among others) for companies, Microsoft released a cloud solution and subscription-based service in June 2011 (i.e. Office 365) which only allowed for integration with on-premises (AD RMS) encryption service for exchange online at the time.

Later in 2013 Azure RMS was released, making use of the Azure Active Directory, associated with the Office 365 directory. Azure RMS would allow integration with the on-premises solutions, allowing for customers already using the service on premises (with respective templates and permissions) to be able to use them in Azure RMS for the cloud-based users as well.

As an example, IRM is to RMS what Microsoft Office Outlook is to Exchange.

“Ok, Azure RMS and IRM. But what About OME?”

OME stands for “Office Message Encryption” and started as an Office integration with document protection. OME is currently the external “branding” part of the IRM as it is tightly integrated with it and with document protection (email attachments). OME also evolved, allowing company marketing on Exchange’s encrypted emails across different organizations.

Cloud Services features and integration with Exchange Online:

Azure RMS divides into Labeling/Classification and Protection. To explain the “Azure Protection” evolution on Exchange Online, we need to consider that, when on cloud, Azure RMS had several builds, initially similar to the On-premises solutions, but with its own “cloud” properties. We can presently consider two main versions of Azure RMS, Version 2 being the most recent.

Currently, version 2 holds a lot of the main features with more security policies features, more device and OS compatibility and more customizations.

Still, there are some differences that an Exchange Administrator should consider when deploying, specially, if the organization had the system previously enabled (or even an On-premises deployment in Hybrid Environments):

With Azure RMS on Exchange Online, email encryption improved considerably, both in terms of user use as admin control:

-Besides licensing, Version 2 activation requires only one action (either on portal or via powershell:

Set-IrmConfiguration -AzureRMSLicensingEnabled $True -InternalLicensingEnable $True)

NOTE: Version 1 would require more configuration steps on PowerShell (like importing the “trusted published domain” (TPD) policy and setting service location)

-On version 2, to update template permissions/settings, you just save changes on Azure portal to update (“Publish” button no longer used, as templates are published automatically when saving)

NOTE: Version 1 required having to re-import the TPD each time changes were made to the templates

-Version 2 is compatible with version 1 if it has been set*. If this isn’t true, actions like “Apply previous Version of OME” on a transport rule in Exchange Online will not work

*Important: The only version 1 templates that will not work with version 2 are the “Scoped Templates”. Version 2’s scope policies are defined in the main portal, not on the template.

-Version 2 also improved by being compatible with more email providers, not only Outlook.com or Hotmail.com but also with gmail, yahoo, etc.

The next topic to approach is licensing. Licenses in Office 365 contain plans, and these are essential for the services to work properly. Azure Information Protection is no different, as there are certain features that depend on the plan.

For the service to work, according to Azure Information Protection Documentation:

“(…) To use this data protection solution, your organization must have a service plan that includes the Azure Rights Management service from Azure Information Protection. Without this, the Azure Rights Management service cannot be activated. You must have one of the following:

An Azure Information Protection plan

An Office 365 plan that includes Rights Management (E3 and up)”

Regarding Exchange Online, E3 contains the “Azure Rights Management” plan, which grants access to Azure RMS protection features, like email or document encryption. For the labeling or other specific features, an Azure Information Plan (it can be plan 1 or plan 2, depending on Feature) is needed. You can verify each plan features via the link https://azure.microsoft.com/en-us/pricing/details/information-protection/

Very Important: “(…) Some Azure Information Protection features require a subscription to Office 365 ProPlus, which is not included with Office 365 Business Essentials, Office 365 Business Premium, Office 365 Enterprise E1, Office 365 Education, or Office 365 Enterprise F1.”

https://technet.microsoft.com/library/exchange-online-service-description.aspx

On Premises, Azure Information Protection Offers two solutions in case of Hybrid Deployments:

If you have an AD RMS on premises, you can migrate your templates to Azure RMS, making them accessible to cloud users. You can also choose to manage your key or have Microsoft manage it. You can check it on https://docs.microsoft.com/en-us/azure/information-protection/get-started/requirements-servers

Alternately, customers not having an AD RMS on premises can still use Azure Information Protection by deploying the Azure RMS Connector (keep in mind that the connector should not be installed in a computer which has IIS services installed and configured on it, like a web app for example). More information on https://docs.microsoft.com/en-us/azure/information-protection/deploy-use/deploy-rms-connector

These options will extend some Azure RMS features to Exchange on premises servers, although with some limitations.

Note: Currently, on premises OWA users do not have access to the “Protect” option as Exchange Online OWA users. They are still able to open encrypted messages but, for version 2 template selection, they should use Outlook Client with Azure Information Protection Tool installed. This is one of said examples.

Not less important, here are some additional considerations in Exchange:

-Keep in mind that RMS protected emails need to be taken into consideration when performing context search or eDiscovery

-The “Do Not Forward” and “Encrypt” templates are policies that come from Exchange Online side when IRM is enabled.

These are not directly managed by the Azure Information Protection

-On OWA, email protection is applied via the “Protect” button

-For Outlook, The Azure Information Protection tool installation is needed to be able to have the “Protect” icon

-Currently, Outlook does not support the “Encrypt” template which can only be opened in OWA.

If an email with this template is received, Outlook will open the message on OWA automatically

For assistance on configuring the services, there is a script made by Microsoft's Exchange Escalation Team which can be used:

(Credit to my colleagues Daniel and Victor): https://blogs.technet.microsoft.com/exovoice/2018/02/26/office-message-encryption-configuration-and-troubleshooting/

In conclusion, in Exchange Online when the user accesses their mail client (web or desktop client) and tries to see the RMS Templates, Exchange’s IRM will query RMS which in turn would query Azure Active Directory to see if the user has permission or is within the RMS template scope, which gives the user permissions to use it or to decrypt it. It’s the policy within the file that it’s queried, not the content. Exchange Online and Azure RMS integration has brought Organization control to help secure email messages, documents, and sensitive data that is shared outside company walls.

How to copy single items from one mailbox to another by using EWS Editor

Silvia Marinova — Wed, 18 Apr 2018 16:10:17 GMT

Imagine that you need to need to copy particular mailbox items (such as - mails, contacts, notes, etc.) from one mailbox to another but you can’t export a .PST file because your organization doesn’t use Outlook and you can’t forward such objects to their new destination. An easy way for you to do so as administrator would be to use EWS Editor. You can manage various items as I’ve mentioned above – all you have to do is navigate to the folder containing them, identify the items and perform the desired actions. The steps below describe how to copy single calendar items from one mailbox to another. First thing’s first – we need to have permissions over the mailbox objects which we will be handing. Easiest way to get them is to use impersonation. How to assign impersonation permissions: https://msdn.microsoft.com/en-us/library/office/bb204095%28v=exchg.140%29.aspx?f=255&MSPPError=-2147217396 If you are an Exchange Online customer, you need to connect to the service through PowerShell and execute the cmdlet below: New-ManagementRoleAssignment –Name:impersonationAssignmentName –Role:ApplicationImpersonation –User:ACCOUNT Ensure that you have the permissions: Get-ManagementRoleAssignment –Role:ApplicationImpersonation After you have the rights to impersonate the mailbox objects, you can copy the data. Below you will see a step by step guide on how to do this by using the EWS Editor tool.

Download the EWS editor from our open-source tools site ( https://ewseditor.codeplex.com/ ), unzip it and double-click EWSEditor.exe to start it.
Click File and then click New Exchange Service.

3. Select ‘Service URL’ and click ‘365 Default’, choose ‘Use the following credentials instead of the default Windows credentials.’, enter the credentials of the Office 365 account which you use for impersonation and hit OK: 4.Click Yes to add the mailbox root to the tree view. 5. Right click your top folder and choose Add Root Folder. 6. Select ‘Identify folder by well known name’ and then enter in the SMTP address of the mailbox from which you want to copy the content: NOTE: Make sure there isn’t a space at the end so it doesn’t fail. 7. Expand the hierarchy of the mailbox and search for Top of Information Store and expand it. Note: The name of the folder can vary depending on the language set for the mailbox. 8. Double click the ‘Calendar’ folder (or the location you need), new window will pop-up and show you the calendar objects: 9. Select the meeting you would like to copy to your personal calendar, right click ‘Copy Item’ Note: You can manipulate just 1 object at the time. 10. Within the new window select from the drop down menu ‘Calendar ‘ for a ‘Root Folder’ (or another location) and insert the address of the mailbox to which you want to copy the data, then hit OK A window notification will be letting you know if the result of the action is successful or not And that's all - you have copied the item!

Office Message Encryption Configuration and Troubleshooting

Victor Legat — Mon, 26 Feb 2018 11:04:18 GMT

With Office 365 Message Encryption, an organization can send and receive encrypted email messages between people inside and outside its organization. We have this functionality for a while in Office 365. This is also called Office 365 Message Encryption version 1 (OMEv1). In the last fall we received a new version of Office 365 Message Encryption, version 2 (OMEv2) which is based on Azure Information Protection (AIP) and allows organization not only to encrypt but also to protect emails & documents on the entire life of them. OMEv2 also adds the capability to work with partners and external recipients. New information about OME setup and capabilities you can find in the following articles: - Set up new Office 365 Message Encryption capabilities built on top of Azure Information Protection - https://docs.microsoft.com/en-us/information-protection/ My colleague Daniel David and I started writing this blog post and building a script as we found as some of the capabilities are sometimes misunderstood and/or misconfigured. Currently both versions can be used independently or mixed if they are configured correctly. With the script we wrote we tried to address OME configurations in all these situations. You can find the script on TechNet Gallery: Office Message Encryption Configuration and Troubleshooting Important: the script is provided with the following Disclaimer: You can find bellow the main menu: You have the possibility of checking: - the current configuration - enable/disable OME versions - view and export templates/labels details - check known issues - export and check logs - open or refresh cache IRM folder or registry Bellow there are few screenshots from the execution of the script:

How to add a new a alias to an existing Office 365 group

Cristian Nitu — Thu, 11 Jan 2018 11:55:12 GMT

Some time ago I worked with an organization that had difficulties in receiving emails on a newly added address. The Organization used “Set-UnifiedGroup” cmdlet to successfully add a new alias to an existing Office 365 group, but external senders were receiving the following NDR: “550 5.4.1 [newaddress@contoso.com]: Recipient address rejected: Access denied” upon sending an email to the new address. So, I've decided to write a script and help this organization. Scenario:

You want to add a new alias to an existing Office 365 Group.
You want external senders to be able to send emails to the new alias.

Current limitations:

It is not possible to add a new alias to an existing Office 365 Group in EAC.
The new alias is not replicated to DBEB (resulting in a rejection if an email is sent to the new address).

Workaround:

Use the Set-UnifiedGroup PowerShell cmdlet to add an alias to an existing Office 365 group (ex. Set-UnifiedGroup -Identity current_group_address@contoso.com -EmailAddresses: @{add="smtp:newaddress@contoso.com"}
Force the replication in DBEB by changing the primary address in Exchange Online (ex. Set-UnifiedGroup -PrimarySmtpAddress newaddress@contoso.com)

DISCLAIMER: This application is a sample application. The sample is provided “as is” without warranty of any kind. Microsoft further disclaims all implied warranties including without limitation any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the samples remains with you. In no event shall Microsoft or its suppliers be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, data loss or other pecuniary loss arising out of the use of or inability to use the samples, even if Microsoft has been advised of the possibility of such damages. Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you. Prerequisites:

To be able to run the script you need to install on the computer the prerequisites described in the following article Connect to Office 365 PowerShell

Script logic:

Before taking any actions, the script tries to do some basic verifications:
- Checks if the Current Group Address really exists in Exchange Online
- Checks if the Current Group Address is the primary address (as at the end we will set it back)
- Checks the domain of the New Group Address
- Checks if the New Group Address already exists in Exchange Online
- Checks if the New Group Address already exists in Azure AD
Adds the New Group Address to the Office 365 group
Sets the New Group Address as primary address in order to replicate it in DBEB
Reverts the primary address to Current Group Address

Script Sample: #------------------------------------------------------------------------------ # # Copyright © 2017 Microsoft Corporation. All rights reserved. # # THIS CODE AND ANY ASSOCIATED INFORMATION ARE PROVIDED “AS IS” WITHOUT # WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT # LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS # FOR A PARTICULAR PURPOSE. THE ENTIRE RISK OF USE, INABILITY TO USE, OR # RESULTS FROM THE USE OF THIS CODE REMAINS WITH THE USER. # #------------------------------------------------------------------------------ # # PowerShell Source Code # # NAME: # Office365_add_alias.ps1 # # VERSION: # 1.0 # #------------------------------------------------------------------------------ [CmdletBinding()] param ( [Parameter(Mandatory = $True, Position = 0)] [ValidateNotNullOrEmpty()] [string]$CurrentGroupAddress, [Parameter(Mandatory = $True, Position = 1)] [ValidateNotNullOrEmpty()] [string]$NewGroupAddress ) #region Set Up Variables $Matcheduser = $Null $Matchedgroup = $Null $MatchedOldGroup = $Null $Objid = $Null $CheckDomain = $Null $AllUsers = $Null $AllGroups = $Null $MatchedUnifiedOldGroup = $Null $MatchedRecipient = $Null $MatchedMSODS = $Null $MatchedEXO = $Null $UserMatchFound = $false $GroupMatchFound = $false $MSODSEmailAddress = $Null $CounterEXO = 6 $CounterMSODS = 6 $CheckEXO = $Null $CheckMSODS = $Null #endregion #region Connect to Office 365 try { # Connect to Azure AD Write-Host "Please enter your Office 365 credentials" -ForeGroundColor Green $O365Cred = Get-Credential Import-Module MSOnline Write-Host "`nConnecting to Azure AD..." Connect-MsolService –Credential $O365Cred # Connect to Exchange Online Write-Host "`nConnecting to Exchange Online..." $O365Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "https://outlook.office365.com/powershell-liveid/" -Credential $O365Cred -Authentication "Basic" -AllowRedirection Import-PSSession $O365Session -DisableNameChecking -AllowClobber | ft } catch { Write-Host "`nUnable to connect to Office 365`n" -Foregroundcolor Red Read-Host “Press ENTER to exit...” Exit } #endregion #region Checking if the old address exists Write-Host "Checking the address $CurrentGroupAddress in Exchange Online" $MatchedUnifiedOldGroup = Get-UnifiedGroup -Identity $CurrentGroupAddress -ErrorAction SilentlyContinue | select Name, EmailAddresses if ($MatchedUnifiedOldGroup -eq $Null) { Write-Host "`tI was not able to find $CurrentGroupAddress in Exchange Online `n"-Foregroundcolor Red Read-Host “Press ENTER to exit...” Exit } else { Write-Host "`tDone. The address $CurrentGroupAddress was found in Exchange Online`n" -Foregroundcolor Yellow } Write-Host "Checking the address $CurrentGroupAddress in Azure AD" $MatchedOldGroup = Get-MsolGroup -All -SearchString $CurrentGroupAddress | select ObjectId,proxyAddresses if ($MatchedOldGroup -eq $Null) { Write-Host "`tI was not able to find $CurrentGroupAddress. Are you sure this is the primary address of the group?`n"-Foregroundcolor Red $Objid = (Get-UnifiedGroup $CurrentGroupAddress).ExternalDirectoryObjectId $MSODSEmailAddress = Get-MsolGroup -ObjectId $objid |select EmailAddress Write-Host "Based on Exchange Online info $($MSODSEmailAddress.EmailAddress) might be the primary address. Would you like me to use this address instead of $($CurrentGroupAddress)? (Default is No)" -Foregroundcolor Yellow $Readhost = Read-Host "Enter your choice ( y / n ) " Write-Host "`n" Switch ($ReadHost) { Y {$CurrentGroupAddress = $MSODSEmailAddress.EmailAddress} N {Read-Host “Press ENTER to exit...”; Exit} Default {Read-Host “Press ENTER to exit...”; Exit} } } else { Write-Host "`tDone. The address $CurrentGroupAddress was found `n" -Foregroundcolor Yellow } #endregion #region Verify the new address Write-Host "Checking if the address $NewGroupAddress is part of an accepted domain" $CheckDomain = Get-AcceptedDomain -Identity ($NewGroupAddress.Split("@"))[1] -ErrorAction SilentlyContinue If ($CheckDomain -eq $Null) { Write-Host "`tDomain does not exists or is not correct`n" -Foregroundcolor Red Read-Host “Press ENTER to exit...” Exit } else { Write-Host "`tDone. The domain was found `n" -Foregroundcolor Yellow } #endregion #region Checking if new address exists in MSODS Write-Host "Checking if any user in Azure AD contains $NewGroupAddress (this may take a while)..." $AllUsers = Get-MsolUser –All | Select userPrincipalName,proxyAddresses $AllGroups = Get-MsolGroup –All | Select ObjectId,proxyAddresses #loop all users ForEach ($User in $AllUsers) { #loop proxyAddresses ForEach ($UPA in $User.ProxyAddresses) { If ($UPA –Match $NewGroupAddress) { $UserMatchFound = $True $Matcheduser = $User } } } write-host "`tDone. `n" -Foregroundcolor Yellow write-host "Checking if any group in Azure AD contains $NewGroupAddress (this may take a while)..." #loop all groups ForEach ($Group in $AllGroups) { #loop proxyAddresses ForEach ($GPA in $Group.ProxyAddresses) { If ($GPA –Match $NewGroupAddress) { $GroupMatchFound = $True $Matchedgroup = $Group } } } write-host "`tDone.`n" -Foregroundcolor Yellow If ($UserMatchFound -or $GroupMatchFound) { $MatchedMSODS = $true If ($UserMatchFound) { Write-Host "`nThe new address exists in Azure AD" Write-Host "The user $($Matcheduser.userPrincipalName) contains the following addresses: $($Matcheduser.ProxyAddresses)`n" -Foregroundcolor Red Read-Host “Press ENTER to exit...” Exit } Else { Write-Host "`nThe new address exists in Azure AD" Write-Host "`The group $($Matchedgroup.ObjectId) contains the following addresses: $($Matchedgroup.ProxyAddresses)`n" -Foregroundcolor Red Read-Host “Press ENTER to exit...” Exit } } Else { write-host "`tDone. No user or group found in Azure AD`n" -Foregroundcolor Yellow } #endregion #region Checking if new address exists in EXO Write-Host "Checking the address $NewGroupAddress in Exchange Online " $MatchedUnifiedGroup = Get-UnifiedGroup -Identity $NewGroupAddress -ErrorAction SilentlyContinue | select Name, EmailAddresses $MatchedRecipient = Get-Recipient -Identity $NewGroupAddress -ErrorAction SilentlyContinue | select Name, EmailAddresses if (($MatchedUnifiedGroup -ne $Null) -or ($MatchedRecipient -ne $Null)) { $MatchedEXO = $true If ($MatchedRecipient -ne $Null) { Write-Host "`tDone. receipint $($MatchedRecipient.name) contains the following addresses: $($MatchedRecipient.EmailAddresses) `n" -Foregroundcolor Yellow } Else { Write-Host "`tDone. Unified Group $($MatchedUnifiedGroup.Name) contains the following addresses: $($MatchedUnifiedGroup.EmailAddresses) `n" -Foregroundcolor Yellow } Write-Host "The new address already exists`n" -Foregroundcolor Red Read-Host “Press ENTER to exit...” Exit } Else { Write-Host "`tDone. No user or group was found in Exchange Online`n" -Foregroundcolor Yellow } #endregion #region Adding the new address Write-Host "Finished all checks. Moving forward...`n" -Foregroundcolor Green if (!$MatchedMSODS -and !$MatchedEXO) { $Objid = (Get-UnifiedGroup $CurrentGroupAddress).ExternalDirectoryObjectId Write-Host "Adding $NewGroupAddress in Exchange Online" # add the new address Set-UnifiedGroup -Identity $CurrentGroupAddress -EmailAddresses: @{add="smtp:$NewGroupAddress"} do { sleep 10 $CounterEXO-- $CheckEXO = Get-UnifiedGroup -Identity $NewGroupAddress } while (($CounterEXO -ge 0) -and ($CheckEXO -eq $Null)) if ($CheckEXO -eq $Null) { Write-Host "I was not able to add the new address`n" -Foregroundcolor Red Read-Host “Press ENTER to exit...” Exit } Else { Write-Host "`tDone.`n" -Foregroundcolor Yellow } Write-Host "Adding $NewGroupAddress in Azure AD" # Changing the primary address to force the sync Get-UnifiedGroup $CurrentGroupAddress | Set-UnifiedGroup -PrimarySmtpAddress $NewGroupAddress do { sleep 10 $CounterMSODS-- $CheckMSODS = Get-MsolGroup -All -SearchString $NewGroupAddress | select emailaddress Write-Host "`tPlease wait..." } while (($CounterMSODS -ge 0) -and ($CheckMSODS -eq $Null)) if ($CheckMSODS -eq $Null) { Write-Host "I was not able to sync the new address`n" -Foregroundcolor Red Read-Host “Press ENTER to exit...” Exit } Else { Write-Host "`tDone.`n" -Foregroundcolor Yellow } # Changing back the primary address Get-UnifiedGroup $NewGroupAddress | Set-UnifiedGroup -PrimarySmtpAddress $CurrentGroupAddress Write-Host "`nAll Done! Wait 15 mins before doing a test!`n" -Foregroundcolor Yellow Read-Host “Press ENTER to exit...” Remove-PSSession $O365Session } #endregion

Archive public folder emails older than 2 years

Catalin Streang — Wed, 20 Dec 2017 18:12:09 GMT

As we all know, retention policies aren't supported for public folder mailboxes. In case you want to archive/move your old public folder emails to a public folder, specially created for archiving, this script might turn to be useful. First, it prompts you to create the public folder (archive) and then, it is recursively returning the public folder structure and looks in each folder for any items older than two years. Prerequisites: -The script requires EWS Managed API 2.2, which can be downloaded here: https://www.microsoft.com/en-gb/download/details.aspx?id=42951 -The "Default" user for each public folder (Get-PublicFolderClientPermission \PF -User Default) needs to have at least 'Author' permissions (which are actually the default), or of course, you can assign specific permissions to the mailbox that you are using to access the public folder structure. -The mailbox that you are using to access the public folder structure needs to have owner permissions on the public folder root ("\) to be able to create the public folder archive.

DISCLAIMER: This application is a sample application. The sample is provided "as is" without warranty of any kind. Microsoft further disclaims all implied warranties including without limitation any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the samples remains with you. in no event shall Microsoft or its suppliers be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss arising out of the use of or inability to use the samples, even if Microsoft has been advised of the possibility of such damages). Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you.



Import-Module -Name "C:\Program Files\Microsoft\Exchange\Web Services\2.2\Microsoft.Exchange.WebServices.dll"

$service = New-Object Microsoft.Exchange.WebServices.Data.ExchangeService -ArgumentList Exchange2013_SP1

#Provide the credentials
$credential = Get-Credential -Message "Type the credentials of the mailbox with access to the public folders that you want to process for archiving"
$service.Credentials = new-object Microsoft.Exchange.WebServices.Data.WebCredentials -ArgumentList $credential.UserName, $credential.GetNetworkCredential().Password

#Exchange Online URL
$service.Url= new-object Uri("https://outlook.office365.com/EWS/Exchange.asmx")

$RootFolderId = New-Object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::PublicFoldersRoot, $credential.UserName)


#Create the archive/public folder (you need owner permissions on the Root folder "\")
$TargetFolderName = Read-Host "Type the name of the public folder archive"

$TargetFolder = new-object Microsoft.Exchange.WebServices.Data.Folder($service)

$TargetFolder.DisplayName = $TargetFolderName

$TargetFolder.Save($RootFolderId)


#Get the Public folder structure
 GetPublicFolder -FolderId $RootFolderId



function GetPublicFolder ()

{

param (
 $FolderId = "$( throw 'FolderId is a mandatory Parameter' )"
       )

$FolderView = New-Object Microsoft.Exchange.WebServices.Data.FolderView(100)

$FolderView.Traversal = [Microsoft.Exchange.WebServices.Data.FolderTraversal]::Shallow

$pspropset = New-Object Microsoft.Exchange.WebServices.Data.PropertySet ([Microsoft.Exchange.WebServices.Data.BasePropertySet]::IdOnly,

[Microsoft.Exchange.WebServices.Data.FolderSchema]::FolderClass,

[Microsoft.Exchange.WebServices.Data.FolderSchema]::DisplayName,

[Microsoft.Exchange.WebServices.Data.FolderSchema]::ChildFolderCount)


$PR_Folder_Path = New-Object Microsoft.Exchange.WebServices.Data.ExtendedPropertyDefinition (26293,[Microsoft.Exchange.WebServices.Data.MapiPropertyType]::String)

$SearchFilter = New-Object Microsoft.Exchange.WebServices.Data.SearchFilter+IsEqualTo ([Microsoft.Exchange.WebServices.Data.FolderSchema]::FolderClass, "IPF.Note")

$pspropset.Add($PR_Folder_Path)

$FolderView.PropertySet = $pspropset


$FindFolderResults = $service.FindFolders($FolderId,$SearchFilter,$FolderView)



if($FindFolderResults.TotalCount)

{

foreach ($Folder in $FindFolderResults.Folders) 
{
Write-Host "Checking if there are messages older than 2 years in the public folder $($Folder.ExtendedProperties.Value)" -ForegroundColor White

PublicFolderEmails -FolderId $Folder.Id


if($Folder.ChildFolderCount){ GetPublicFolder -FolderId $Folder.Id }

}

}
}



function PublicFolderEmails
{

param (
 $FolderId = "$( throw 'FolderId is a mandatory Parameter' )"
 )


$ItemView = New-Object Microsoft.Exchange.WebServices.Data.ItemView(1000)

$pspropset = New-Object Microsoft.Exchange.WebServices.Data.PropertySet ([Microsoft.Exchange.WebServices.Data.BasePropertySet]::IdOnly,
                                                                         [Microsoft.Exchange.WebServices.Data.ItemSchema]::DateTimeReceived,
                                                                         [Microsoft.Exchange.WebServices.Data.ItemSchema]::DateTimeSent)

$ItemView.PropertySet = $pspropset

$FindItemResults = $service.FindItems($FolderId,$ItemView)



if ($FindItemResults.TotalCount)  {

foreach($Item in $FindItemResults.Items)

{


if([datetime]$Item.DateTimeReceived -le (get-date).adddays(-730) -or [datetime]$Item.DateTimeSent -le (get-date).adddays(-730))

{
#Move the items older than 2 years in the target/archive public folder

$Message = [Microsoft.Exchange.WebServices.Data.EmailMessage]::Bind($service,$Item.Id)

$Message.Move($TargetFolder.Id)

}

}

}

}

Note: In case you want to create a folder within the primary mailbox structure (of the account used to access the public folders) and move the public folder emails older than two years there, you can do that as well. However, the script has to be slightly changed.

How to remove the MobilePhone from my Public Folder contacts?

Catalin Streang — Fri, 08 Dec 2017 12:06:41 GMT

In case you want to remove the "MobilePhone" property for all your public folder contacts, you can use this script. The same reasoning applies for other properties, with the mention that you need to load the corresponding extended property for them. Prerequisites: -The script requires EWS Managed API 2.2, which can be downloaded here: https://www.microsoft.com/en-gb/download/details.aspx?id=42951 -You need to be connected to Exchange Online when you run the script (copy/paste it into a Notepad file and save it with the extension ".ps1"): https://technet.microsoft.com/en-us/library/jj984289(v=exchg.160).aspx

DISCLAIMER: This application is a sample application. The sample is provided "as is" without warranty of any kind. Microsoft further disclaims all implied warranties including without limitation any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the samples remains with you. in no event shall Microsoft or its suppliers be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss arising out of the use of or inability to use the samples, even if Microsoft has been advised of the possibility of such damages). Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you.



$PF = Read-Host -Prompt "Public Folder identity (e.g. \PF1, \PF1\SubPF1)"

Import-Module -Name "C:\Program Files\Microsoft\Exchange\Web Services\2.2\Microsoft.Exchange.WebServices.dll"

$service = New-Object Microsoft.Exchange.WebServices.Data.ExchangeService -ArgumentList Exchange2013_SP1

#Provide the credentials
 $credential = Get-Credential -Message "Type the credentials of the mailbox that you intend to use to connect to the public folder"

$service.Credentials = new-object Microsoft.Exchange.WebServices.Data.WebCredentials -ArgumentList $credential.UserName, $credential.GetNetworkCredential().Password

#Exchange Online URL
 $service.Url= new-object Uri("https://outlook.office365.com/EWS/Exchange.asmx")


function Convert($c)
{
$aiItem = New-Object Microsoft.Exchange.WebServices.Data.AlternatePublicFolderId

$aiItem.FolderId = $c

$aiItem.Format = [Microsoft.Exchange.WebServices.Data.IdFormat]::HexEntryId

$convertedId = $service.ConvertId($aiItem, [Microsoft.Exchange.WebServices.Data.IdFormat]::EwsId)

$folderid = new-object Microsoft.Exchange.WebServices.Data.FolderId($convertedId.FolderId)

return $folderid;
}

$SourcePF = Convert (Get-PublicFolder $PF).EntryId

$psPropertySet = new-object Microsoft.Exchange.WebServices.Data.PropertySet([Microsoft.Exchange.WebServices.Data.BasePropertySet]::FirstClassProperties)

$MobilePhone = new-object Microsoft.Exchange.WebServices.Data.ExtendedPropertyDefinition(0x3A1C, [Microsoft.Exchange.WebServices.Data.MapiPropertyType]::String)

$psPropertySet.Add($MobilePhone)


$ItemView = new-object Microsoft.Exchange.WebServices.Data.ItemView(1000)

do

{

$FindItemResults = $service.FindItems($SourcePF,$ItemView)

if($FindItemResults.TotalCount){

write-host "$($FindItemResults.TotalCount) contact(s) has/have been found in the source folder" -ForegroundColor White

[void]$service.LoadPropertiesForItems($FindItemResults,$psPropertySet)


foreach($Item in $FindItemResults.Items)
{

if ($Item.ItemClass -match "IPM.Contact" -and $Item.ExtendedProperties.Value)
{

$Contact = [Microsoft.Exchange.WebServices.Data.Contact]::Bind($service,$Item.Id,$psPropertySet);

Write-Host "Removing the MobilePhone for the contact: $($Contact.DisplayName)" -ForegroundColor White

$Contact.RemoveExtendedProperty($MobilePhone)

$Contact.Update([Microsoft.Exchange.WebServices.Data.ConflictResolutionMode]::AlwaysOverwrite)

}

}

}

else { Write-Host "The Public Folder is empty!" -ForegroundColor Yellow; break; }

$ItemView.offset += $FindItemResults.Items.Count

}

while($FindItemResults.MoreAvailable -eq $true)

Disable automatic forwarding in Office 365 and Exchange Server to prevent information leakage

Silvia Marinova — Thu, 07 Dec 2017 12:43:09 GMT

This article is describing a brief guide on how to prevent internal users from auto-forwarding emails to external mailbox users and on how to disable automatic email forwarding in Office 365 and Exchange Server. Allowing users to use mail auto-forwarding brings the risk of information leakage. Additionally, users can select the option to not keep a copy of the message in the mailbox which could also result in data loss. How to remove the automatic email forwarding options from Outlook on the web (OWA) in Exchange Server and Exchange Online

Automatic email forwarding options in Outlook Web App in Exchange Server and Exchange Online

In Exchange administrators control which actions can be performed by the users through Role Based Access Control. To remove the option shown in the picture above you need to modify the Default Role Assignment Policy. The Default Role Assignment Policy contains a Management Role called MyBaseOptions which is holding the parameters responsible for the forwarding and letting users perform the desired changes through the graphical interface of OWA by running Set-Mailbox on the background : DeliverToMailboxAndForward The DeliverToMailboxAndForward parameter specifies the message delivery behavior when a forwarding address is specified by the ForwardingAddress or ForwardingSmtpAddress parameters. ForwardingAddress The ForwardingAddress parameter specifies a forwarding address for messages that are sent to this mailbox. A valid value for this parameter is a recipient in your organization. You can use any value that uniquely identifies the recipient. ForwardingSmtpAddress The ForwardingSmtpAddress parameter specifies a forwarding SMTP address for messages that are sent to this mailbox. Typically, you use this parameter to specify external email addresses that aren't validated. As you can’t modify the build-in role MyBaseOptions, you need to create a new role to replace it with.

Create a new management role based on the MyBaseOptions role: New-ManagementRole MyBaseOptions-DisableForwarding -Parent MyBaseOptions
Remove the forwarding parameters from the MyBaseOptions-DisableForwarding role Set-ManagementRoleEntry MyBaseOptions-DisableForwarding\Set-Mailbox -RemoveParameter -Parameters DeliverToMailboxAndForward,ForwardingAddress,ForwardingSmtpAddress
Note: If you want to retrieve the parameters that will be left available for the Set-Mailbox cmdlet after the modification of the role which you’ve created:

(Get-ManagementRoleEntry MyBaseOptions-DisableForwarding\Set-Mailbox).parameters
As you have created the role, you have 2 options – modifying the default policy for all users or creating a different policy and assign it to a targeted group of people. 3.1. Modify the Default Role Assignment Policy for all users by replacing MyBaseOptions with MyBaseOptions-DisableForwarding.The easiest way to do this is from Exchange Admin Center > Permissions > User Roles > edit the Default Role Assignment Policy > clear MyBaseOptions and then select MyBaseOptions-DisableForwarding.3.2. Create a new role assignment policy which will contain the MyBaseOptions-DisableForwarding role New-RoleAssignmentPolicy -Name DisabledForwardingRoleAssignmentPolicy -Roles MyBaseOptions-DisableForwarding,MyContactInformation,MyRetentionPolicies,MyMailSubscriptions,MyTextMessaging,MyVoiceMail,MyDistributionGroupMembership,MyDistributionGroups, MyProfileInformationAfter creating the new policy, you can apply it to targeted user for example: Set-Mailbox –Identity user@domain.com -RoleAssignmentPolicy DisabledForwardingRoleAssignmentPolicyNote: Give it some time to replicate after the change. The expected result of both of the actions is the following:

Removing any existing auto-forwarding left from before the implementation of the new role As the forwarding can be set to both internal and external recipients you might want to export a list of the mailboxes which had configured the settings before the Role Assignment Policy modifications. This will allow you to remove only the forwarding to external addresses with precision: Get-Mailbox -ResultSize Unlimited -Filter {(RecipientTypeDetails -ne "DiscoveryMailbox") -and ((ForwardingSmtpAddress -ne $null) -or (ForwardingAddress -ne $null))} | Select Identity | Export-Csv c:\ForwardingSetBefore.csv -append If you want to remove any kind of forwarding regardless the location: Get-Mailbox -filter {(RecipientTypeDetails -ne "DiscoveryMailbox") -and ((ForwardingSmtpAddress -ne $null) -or (ForwardingAddress -ne $null))} | Set-Mailbox -ForwardingSmtpAddress $null -ForwardingAddress $null Disable forwarding set through Inbox Rules As the Inbox Rule are frequently created by the users and can’t be blocked on server side (unless you disable the creation of Inbox rules which allow forwarding and redirection as described HERE), you need to disable this on a Remote Domain level. The cmdlet below will disable the forwarding to all external domains. If you want to restrict this for particular domains only replace you can do so as well. Set-RemoteDomain Default -AutoForwardEnabled $false Or you can clear the selection for the Default Remote Domain settings from Exchange Admin Center > Mail Flow > Remote Domains As that setting will be applicable for all newly sent emails but will not eliminate the rules, you can use the cmdlet below will export a list of the mailboxes which have forwarding, redirection or message deletion rules configured, review them and remove them upon demand as well: foreach ($a in (Get-Mailbox -ResultSize Unlimited |select PrimarySMTPAddress)) {Get-InboxRule -Mailbox $a.PrimarySMTPAddress | ?{($_.ForwardTo -ne $null) -or ($_.ForwardAsAttachmentTo -ne $null) -or ($_.DeleteMessage -eq $true) -or ($_.RedirectTo -ne $null)} |select Name,Identity,ForwardTo,ForwardAsAttachmentTo, RedirectTo, DeleteMessage | Export-Csv c:\temp\InboxRules.csv -append } Remove-InboxRule -Mailbox user@domain.com -Identity "RuleName" Note: In case you are facing an issue with corrupted or hidden Inbox rules, yet you still want to remove them, please consult the following article. Another option which you might consider, as it will be notifying your users as well, is to configure a transport rule to handle the blocking of any auto-forward message types: Note: Applying the following action 'Enable Client Rules Forwarding Block Advanced Action' from Secure Score in Office 365 Security and Compliance Center will create a new transport rule for your organization. It will stop external messages leaving your Tenant, that are of the type AutoForward, mitigating the use of Client created external mail forwarding rules and malicious Remote Domain entries as a data exfiltration vector. If The Sender is located 'Inside the organization' If The Recipient is located 'Outside the organization' If The message type is 'Auto-Forward' Reject the message with the explanation 'External Mail Forwarding via Client Rules is not permitted' The steps mentioned above aren't going to be reflected in the Secure Score. In order for you to obtain the Action Score Points you need to apply the rule from Secure Score.

One of the required migration features (PAW) isn't enabled

Cristian Dimofte [MSFT] — Mon, 20 Nov 2017 15:08:21 GMT

Check the article I've wrote on answers.microsoft.com about this.

EXO Voice

Use PowerShell formatting features to your advantage!

How to set up IIS to send emails using Office 365

Which solution should you choose

Which changes you need to implement

SMTP Client Submission

Configuration Changes Required

Direct Send

Configuration Changes Required

SMTP Relay

Configuration Changes Required

Which IIS settings you need to configure

SMTP Client Submission

Relay Restrictions

Change Outbound Port

Configure Smart Host

Configure Recipient Domain Options

SMTP Relay/Direct Send

Configure IIS for relaying

Configure Relay Restrictions

Configure Outbound Security

Troubleshoot SMTP Client Submission

Troubleshoot Direct Send

Troubleshoot SMTP Relay

IIS Specific Troubleshooting

Email Encryption in Office 365

How to copy single items from one mailbox to another by using EWS Editor

Office Message Encryption Configuration and Troubleshooting

How to add a new a alias to an existing Office 365 group

Archive public folder emails older than 2 years

How to remove the MobilePhone from my Public Folder contacts?

Disable automatic forwarding in Office 365 and Exchange Server to prevent information leakage

Automatic email forwarding options in Outlook Web App in Exchange Server and Exchange Online

Note: If you want to retrieve the parameters that will be left available for the Set-Mailbox cmdlet after the modification of the role which you’ve created:

(Get-ManagementRoleEntry MyBaseOptions-DisableForwarding\Set-Mailbox).parameters

One of the required migration features (PAW) isn't enabled