Jason Ross

SharePoint Online Management Shell & Forcing Modern Authentication

Jason A Ross — Wed, 04 Oct 2017 09:00:51 GMT

I recently worked with a customer that had a unique ADFS setup within their organization. The organization had added an ADFS Claim rule to block legacy authentication requests if they did not originate from an expected IP address range. After doing so Connect-SPOService still worked however, when saving credentials to a variable using Get-Credential then passing to Connect-SPOService it would fail. When using Connect-SPOService by itself, it will prompt for credentials and you are able to login successfully. The moment you assign your credentials to a variable using Get-Credential then pass that variable to Connect-SPOService you will receive an error message saying: The partner returned a bad sign-in name or password error. Remember, not everyone will have this issue. This has to do with the unique ADFS setup that I talked about in the opening paragraph of this Blog post. You may ask, why don't I just authenticate using Connect-SPOService by itself without saving my credentials to a variable? The answer is that if I want to re-use these credentials later in my PowerShell script, I will be unable to do so without the script stopping until I enter my credentials again as they are not assigned to a variable. Below are the steps that work:

Connect-SPOService -Url https://contoso-admin.sharepoint.com

Below are the steps that do not work:

$creds = Get-Credential
Connect-SPOService -Url https://contoso-admin.sharepoint.com -Credential $creds
Connect-SPOService : The partner returned a bad sign-in name or password error. For more information, see Federation
Error-handling Scenarios.
At line:1 char:1
+ Connect-SPOService -Url https://contoso-admin.sharepoint.com -Credenti ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 + CategoryInfo : NotSpecified: (:) [Connect-SPOService], IdcrlException
 + FullyQualifiedErrorId : Microsoft.SharePoint.Client.IdcrlException,Microsoft.Online.SharePoint.PowerShell.Connec
 tSPOService

The workaround that we found was to add a registry key on the client computer that is using the SharePoint Online Management Shell. Once we add the registry key it forced Modern Authentication and we were able to get this scenario to work. Below is the registry key:

HKEY_CURRENT_USER\Software\Microsoft\SPO\CMDLETS]
"ForceOAuth"=dword:00000001

Now when we store our credentials in a variable and pass that variable to Connect-SPOService it works. Please keep in mind that this post was created in October of 2017 and may no longer be relevant in future releases in the SharePoint Online Management Shell. Also, always be careful when modifying the registry and take a backup before doing so.

SharePoint Online and Mapped Network Drives

Jason A Ross — Tue, 08 Aug 2017 12:57:20 GMT

Mapped network drives are become a thing in the past with SharePoint Online as we now have the OneDrive for Business Sync Tool that can be used to sync files from SharePoint Online or OneDrive for Business. The sync client offers a seamless way to sync files from your devices and it just works. If you are still using mapped network drives you may run into issues if your client PC is not configured correctly. Also, with SharePoint Online you will have to make sure to login and authenticate to SharePoint Online using a web browser and select Keep me signed in during login to make sure the mapped network drive stays authenticated. Below are things to remember when using mapped network drives with SharePoint Online/OneDrive for Business:

Make sure the WebClient service is set to start Automatically and not Manually in Service.msc (Start > Run > Services.msc)
Make sure that all of your SharePoint Online and OneDrive for Business URL's are in the Trusted Sites list in Internet Explorer
Browse to your SharePoint site and login and make sure to click Keep me signed in during login which will create a persistent cookie
Attempt to map the network drive

If you reboot your PC you will need to make sure that:

You open a web browser and navigate to your SharePoint Online site
Make sure to click Keep me signed in check box to create a persistent cookie

Additional information can be found here which is a Microsoft support article.

How to Complete a Network Trace in Internet Explorer

Jason A Ross — Tue, 08 Aug 2017 06:53:31 GMT

Below are the steps to complete a network trace in Internet Explorer and save the trace file:

Open Internet Explorer
Press F12 (Or click the Gear icon > F12 Developer Tools)
Click the Network tab
Reproduce the issue by navigating to the website
Once done click the Save button
Give the trace a filename and click the Save button which will save it as a .har file or .xml file

Find SharePoint Online Site Owner

Jason A Ross — Mon, 07 Aug 2017 13:13:36 GMT

If you need to find out who a site owner is in SharePoint Online you can do this leveraging the SharePoint Online Management Shell. You must first have the SharePoint Online Management Shell installed on your computer. You need to be a Global Administrator or have a role that allows you to have access to the Tenant Admin site to perform the below steps.

Download the SharePoint Online Management Shell from https://www.microsoft.com/en-us/download/details.aspx?id=35588
Install the SharePoint Management Shell by launching the MSI installation package
Once installed open the SharePoint Online Management Shell
Use Connect-SPOService to connect to your tenant admin site. Below is an example to find the site owner:

Connect-SPOService -Url https://contoso-admin.sharepoint.com -Credential jason@contoso.onmicrosoft.com

$site = Get-SPOSite -Identity https://contoso.sharepoint.com

$site | select Url,Owner

Url Owner
--- -----
https://contoso.sharepoint.com/ jason@contoso.onmicrosoft.com