SharePointWarrior

External Sharing Matrix

Sal Rosales — Mon, 26 Mar 2018 17:41:09 GMT

This matrix was put together by my fellow PFE colleagues Kevin Kirkpatrick. You can view his blog here. This matrix provides the 4 different external sharing options as well as the PowerShell equivalent to set them.

Select this option:	If you want to:	Sharing Capability PowerShell Equivalent
Don’t allow sharing outside your organization	Prevent all users on all sites from sharing sites or sharing content on sites with external users. Users will not be able to share sites or content with external users, even if those users are already in your directory.	Disabled
Allow sharing only with the external users that already exist in your organization’s directory	Allow sharing only for external users who are already in your directory. These users may exist in your directory because they previously accepted sharing invitations or because they were manually imported. (You can tell an external user because they have #EXT# in their user name.)	ExistingExternalUserSharingOnly
Allow external users who accept sharing invitations and sign in as authenticated users	Require external users who have received invitations to view sites or content to sign-in with a Microsoft account before they can access the content. Site owners or others with full control permission can share sites with external users. Site owners or others with full control permissions on a site can share documents with external users by requiring sign-in. All external users will be required to sign in before they can view content. Invitations to view content can be redeemed only once. After an invitation has been accepted, it cannot be shared or used by others to gain access. *In addition this Sharing Setting will allow for "New Secure Sharing experience, secure links.**	ExternalUserSharingOnly
Allow both external users who accept sharing invitations and guest links	Allow site users to share sites with people who sign in as authenticated users, but you also want to allow site users to share documents through the use of anonymous guest links, which do not require invited recipients to sign in. Site owners or others with full control permissions can share sites with external users. All external users will be required to sign in before they can view content on a site that has been shared. When sharing documents, site owners or others with full control permissions can opt to require sign-in or send an anonymous guest link. When users share a document, they can grant external users either view or edit permissions to the doonecument. External users who receive anonymous guest links can view or edit that content without signing in. Anonymous guest links could potentially be forwarded or shared with other people, who might also be able to view or edit the content without signing in.	ExternalUserAndGuestSharing

SharePoint Online External Sharing Demystified (Part 1): Don't allow sharing outside your organization

Sal Rosales — Mon, 26 Mar 2018 17:30:33 GMT

Hi everyone, a lot of customers have questions about SharePoint Online external sharing of sites. What happens when I check this box? I've enabled external sharing but I still can't share externally. I've gone through the current four scenarios with screenshots in the hopes that it will demystify some of these settings. This is the first of 4 blogs on this subject, each to do with each of the admin settings below. Here is a mini table of contents

Scenario 1: Don't Allow Sharing Outside You Organization
Scenario 2: Allow sharing only with the external users that already exist in your organization's directory
Scenario 3: Allow users to invite and share with authenticated external users
Scenario 4: Allow sharing to authenticated external users and using anonymous access links
External Sharing Matrix

Scenario 1: Don't allow sharing outside your organization Note: The settings in the screenshot below are accessible via a Global admin OR a SharePoint Admin (meaning someone who has been granted access to the SharePoint Admin center BY a Global Admin). The location is as follows: O365 Portal>>SharePoint admin>>Sharing' The owner of a site tries to share with a Hotmail account and as expected is prevented from doing hence the red warning text below. I went a step further and, as the Global Admin, added the Hotmail account to Azure AD just to see what would happen I then logged into the Hotmail account as the test External user and made sure to accept the email invitation After the external user accepts the invite they are automatically added to the O365 portal as a Guest account as you can see here from this screenshot Just as before, when the site owner tries to share with the Hotmail account they are prevented from doing so. So my point was, even if the external user was added to AD the setting of Don't Allow Sharing Outside your Organization still prevented the site from being shared.

SharePoint Online External Sharing Demystified (Part 2): Allow sharing only with the external users that already exist in your organization's directory

Sal Rosales — Mon, 26 Mar 2018 17:24:08 GMT

Hi this is the 2nd of 4 blogs on SharePoint Online External Sharing of sites. Here is a mini table of contents

Scenario 1: Don't Allow Sharing Outside You Organization
Scenario 2: Allow sharing only with the external users that already exist in your organization's directory
Scenario 3: Allow users to invite and share with authenticated external users
Scenario 4: Allow sharing to authenticated external users and using anonymous access links
External Sharing Matrix

The settings in the screenshot below are accessible via a Global admin OR a SharePoint Admin (meaning someone who has been granted access to the SharePoint Admin center BY a Global Admin). The location is as follows: O365 Portal>>SharePoint admin>>Sharing Once this option is selected this next screen pops up as a reminder of the fact that SharePoint Site collections also have individual sharing settings that you can set. These SharePoint site collection settings RESPECT the settings of the SharePoint Admin Center. So, this is a reminder and you would click OK to proceed knowing that any site collections that previously had sharing settings enabled will be re-activated since you are activating it at the SharePoint Admin center level. Now, I'd like to talk a bit about these SharePoint Site collection specific sharing settings because if you don't set them inline with your SharePoint admin settings, you could waste a lot of time trying to figure out why your settings in the Admin center are not taking effect. These Site collection settings are also set at the SharePoint Admin center but they are located here: O365 Portal>>SharePoint Admin>>Site Collections. Then you would click on a specific site collection and click on the 'Sharing' icon. This then brings up an additional set of Sharing settings that look exactly like the SharePoint admin settings except they apply specifically to a site collection. NOTE: Now here is where it can get confusing. If your SharePoint Admin center is set to anything other than 'Don't allow sharing outside your organization' BUT your Site Collection is set to the setting you see above, when you go to share the site collection, you will experience the Scenario 1 in my previous blog. You will NOT be able to share it. I wasted a lot of time one late night trying to figure out why I could not share a site because I had set my SharePoint Admin settings to 'Allow sharing only with the external users that already exist in your organizations' directory', then I discovered my site collection specific sharing settings was set to a lower setting. Those lower settings of the site collection ARE RESPECTED over the SharePoint Admin settings. So after I set my Site collection sharing settings to match my SharePoint Admin settings of 'Allow sharing only with the external users that already exist in your organization's directory' the following experience applies. At this point, even if a site owner tries to share the site with an external user it will not work per the setting because the external user has not been added to Azure AD yet. So the site owner will receive this screen. I then proceeded to add the external account to Azure AD. The external user must then accept the email invitation as seen below. As a global admin, I verified that the external Hotmail account is now in Azure AD as well as the o365 portal. NOTE: A side note, is if you delete a user from Azure AD it automatically deletes them from the O365 portal Now when the site owner shares a site with the external user, you will still see the user is not found. Just proceed to send the invite, it will work. This next screen validates my statement. The site owner will see a notification that displays a message 'Shared with: whomever@hotmail.com'. From a SharePoint perspective, the user has been granted permissions to the site. This final screen is what the external user sees when now trying to browse to the site. SUCCESS!!!

SharePoint Online External Sharing Demystified (Part 3): Allow Users to Invite and Share with Authenticated External Users

Sal Rosales — Mon, 26 Mar 2018 17:11:09 GMT

Hi this is the 3rd of 4 blogs on SharePoint Online External Sharing of sites. Here is a mini table of contents

Scenario 1: Don't Allow Sharing Outside You Organization
Scenario 2: Allow sharing only with the external users that already exist in your organization's directory
Scenario 3: Allow users to invite and share with authenticated external users
Scenario 4: Allow sharing to authenticated external users and using anonymous access links
External Sharing Matrix

SharePoint Online External Sharing Demystified (Part 4): Allow sharing to authenticated external users and using anonymous access links

Sal Rosales — Mon, 26 Mar 2018 17:04:09 GMT

Hi this is the 4th of 4 blogs on SharePoint Online External Sharing of sites. Here is a mini table of contents

Scenario 1: Don't Allow Sharing Outside You Organization
Scenario 2: Allow sharing only with the external users that already exist in your organization's directory
Scenario 3: Allow users to invite and share with authenticated external users
Scenario 4: Allow sharing to authenticated external users and using anonymous access links
External Sharing Matrix

Once you choose an option other than 'Don't allow sharing outside your organization' you will receive the following screen as a reminder of the fact that SharePoint Site collections also have individual sharing settings that you can set. These SharePoint site collection settings RESPECT the settings of the SharePoint Admin Center. You would click OK to proceed knowing that any site collections that previously had sharing settings enabled will be re-activated since you are activating it at the SharePoint Admin center level. I make sure that the site collection sharing settings are also set to the same level of sharing, in this case 'Allow external users who accept sharing invitations and sign-in as authenticated users' (see previous blog for a thorough explanation of these settings) The Site Owner is allowed to invite an external user. Now if they user is already in Azure AD then the site owner may see a result listed as below. If not, they user will not be found but that is fine. Proceed to send the invite anyway. We require the user to accept the sharing invite to be added to Azure AD if they are not. Then we add them to the O365 portal as well. The external user will now get an invite in their email like this After clicking on the link from the invite to the site, in this example the 'TeamSite' link, the external user will be taken to this screen. They should choose 'Organizational Account'. One small hurdle that may happen is that after clicking on the 'Organizational Account' the external user may receive a 'You need permission to access this site'. They can then click the 'Request Access' link which will notify the owner of the to specifically approve this request The owner of the site can then approve the access request (Site collection >> Access requests and invitations) via the screen below. Once that is complete the External user will have access to the site.

Powerpivot and the Unattended Service Account

Sal Rosales — Wed, 14 Dec 2016 00:19:11 GMT

My customer had a tough time understanding how the Unattended Service account relates to the actual PowerPivot workbooks. This specific scenario was Powerpivot 2012 and SharePoint 2013. Quick shout out to my colleague Rick Andring for all the help he provided in helping my customer understand all of this stuff. His teams' blog can be found here: https://blogs.technet.microsoft.com/excel_services__powerpivot_for_sharepoint_support_blog/ Here are some best practices/gotchas to keep in mind:

If upgrading Data models from Excel 2010 to Excel 2016, which is what my customer was doing, you must download it to your laptop/desktop, open in Excel 2013, upgrade and then upload it back into the SharePoint document library. It is a best practice to open it and upgrade in Excel 2013 first before going straight to 2016.NOTE: Once upgraded you CANNOT roll back the upgrade, it remains upgraded. Make a copy in case you think you may need to go back to the previous data model
After granting the Unattended Service account read rights to the datasource you wish to query within your workbook, AND after setting up a Target Application in your Secure Store Service AND after referencing it in your Excel Services Service Application, you now have to set your workbook Connection in your workbook to NONE so that it references the Unattended Service Account. WARNING: NEVER EVER EVER modify the default datasource ThisWorkbookDataModel. THIS IS NOT SUPPORTED!! In this example, notice how the datasource called SqlServer PEVMFORKAY1POWERPIVOT Test is selected. This is the connection that will be set to None.
Now if for whatever reason, you or one of your users manages to modify the ThisWorkbookDataModel setting to something other than its default setting, the only way to change it back to its rightful setting of 'Authenticated User account' is to open it in Excel 2013 OR 2016 on a 32-bit machine. If you try to do this on a 64-bit machine the options to change this will be greyed out.

Additional Resources

SharePoint 2013 and PowerPivot 2012: why are there so many data model databases?

Sal Rosales — Wed, 10 Aug 2016 00:08:45 GMT

Problem: My customer sent me a screenshot of their SQL Server Management studio Analysis Services database listing. They were concerned with one of the database model tables appearing multiple times, in this case around 20 times. They asked me how can they determine which of these copies is the one that is active? Just so we are on the same page, when using PowerPivot with SharePoint, a workbook will generate a unique data model database in SQL when the workbook is refreshed, for example, in the browser. The DB I am referencing looks something like this: So in my customer's case they saw something that looked like this in SQL Server Management Studio: my_ExcelWorkbook_xyz5625496587561e052f83b_15a8aa37cc3asdf92e9db_SSPM my_MyStatistics_abc2568941254471411e052f83b_56b98euicc3ckju56bcpw_SSPM my_MyStatistics_abc2568941254471411e052f83b_99avlo3cc3lloik8767s77v_SSPM my_MyStatistics_abc2568941254471411e052f83b_65h6567aloim5625s97vx_SSPM my_MyStatistics_abc2568941254471411e052f83b_115685djxytm324t652jjw_SSPM etc so they were concerned with the my_MyStatistics_GUID_GUID_SSPM appearing so many times Explanation: I have to give a shout out to Rick Andring who explained this phenomenon in detail. The answer to the customer was that ALL of the copies are active. The databases are based on user sessions and will be purged from the system once the user session expires. Each one of the copies is literally a separate model for the same workbook. The first GUID is the model GUID and the second is the session GUID for the user. He explained that he sees this happen when workbooks are configured to refresh when they open: In short, these models clean themselves up eventually. This can also happen on heavily used workbooks where users are refreshing workbooks manually (not just refresh on open), or workbooks that are set to refresh on open and are imbedded into Excel Services web parts. If this is a concern, you can check the workbook to see if it is indeed configured to refresh when it opens and disable it. Then you can schedule the workbook to refresh daily via PowerPivot Scheduled Data Refresh. If people are refreshing this manually, then another strategy may be needed. If you need a quick way to flush the models, simply restart the SSAS instance and the models will rebuild when the workbook is opened. But remember that new models will be rebuilt for every user that refreshes the workbook and you will end up in this same situation.

Fast Search for SharePoint 2010: Crawl running but not crawling content

Sal Rosales — Tue, 19 Jul 2016 17:54:23 GMT

This is an oldie but goodie in the sense that I just resolved this yesterday but my customer is still on SharePoint 2010 and FAST Search 2010. They are nostalgic what can I say Symptoms were that the crawl would run for hours but nothing was logged in the crawl log Problem #1 I looked at the Event log of the SharePoint Server running search 14 and saw ''Failed to connect to xxx:13391 Failed to initialize session with document engine: Unable to resolve Contentdistributor' This is indicative of the certificate expiring. Resolution Problem #1: Certificate expired Since this was a 2 node farm, 1 sharepoint server, 1 FAST Search server we did the following:

Generate a new certificate (per these instructions here)
1. Stop FAST Search Server 2010 for SharePoint on all servers in the farm, including the monitoring service.
2. On the FAST Search administration server:
  1. On the Start menu, click All Programs.
  2. Click Microsoft FAST Search Server 2010 for SharePoint.
  3. Right-click SharePoint 2010 Management Shell, and select Run as administrator.
  4. At the command prompt, browse to installer\scripts under the installation folder.
  5. Type the following command: .\ReplaceDefaultCertificate.ps1 -generateNewCertificate $true
  6. Enter a password for the certificate.
3. Start FAST Search Server 2010 for SharePoint on the administration server.
Copy it over to the SharePoint server running FAST Search connector
1. Copy the script SecureFASTSearchConnector.ps1 from the FAST Search Server 2010 for SharePoint administration server to the SharePoint Server 2010 server that is running the FAST Search connector. The SecureFASTSearchConnector.ps1 script can be found in the installation folder, under \installer\scripts\.
2. On the SharePoint Server 2010 server that is running the FAST Search connector, follow these steps:
  1. On the Start menu, click All Programs.
  2. Click Microsoft SharePoint 2010 Products.
  3. Right-click SharePoint 2010 Management Shell, and select Run as administrator.
  4. Browse to the directory where you copied the SecureFASTSearchConnector.ps1 script and run it, replacing the necessary parameters with the values for your environment. The domain and user name should reflect the details of the user running the SharePoint Server Search 14 service (OSearch14):
    - .\SecureFASTSearchConnector.ps1 -ssaName "name of your content SSA" -username "domain\username"
  - When prompted enter the name of the certificate password that you entered when you first ran the post-setup of FAST Search server for SharePoint 2010

In a properly configured environment the SharePoint Search service will restart and you'll be good to go, in my case we came across this new error: Connection to contentdistributor {server name:13390} could not be validated. Check your certificates and ssa configuration and make sure that the instance of FAST search server backend is running. I've highlighted that port number because that was the clue as to what the next problem was Problem #2: incorrectly configured to use port 13390 According to this KB article: https://support.microsoft.com/en-us/kb/2619798 the FAST Search content distributors need to use 13391 as stated in the install_info.txt.

Go to Central admin>>FAST Search Connector>>Properties in the Ribbon. Find the 'Content Distributors' towards the bottom and change the port number from 13391 to 13390
In this case I also discovered that they had the wrong port configured in their install_info.txt file. So we changed it to 13391k, then saved the file:

FAST Search Content Search Service Application configuration --------------------------------------------------------------- Content Distributors (for PowerShell SSA creation): servername:13391 Content Distributors (for GUI SSA creation): servername:13391 Default Content Collection Name: sp

We restarted the FAST Search service along with the SP Search service for good measure
It took a good 15 minutes for the changes to propagate, we then ran a full crawl and saw that the crawl log was populating. Problems #2 resolved.

Recommendation is to place a meeting on your calendar a week or two before your certificate is set to expire. That way this issue will not catch you by surprise

PowerPivot 2008 R2 and SharePoint 2010: We cannot locate a server to load the workbook Data Model

Sal Rosales — Tue, 05 Jan 2016 23:00:00 GMT

Problem: Customer was experiencing the error below when trying to view a PowerPivot workbook in their SharePoint site. This was only occurring in their production farm.

I also found this error in the logs:

Troubleshooting:

verified they had the SQL Server analysis service instance enabled on the PowerPivot/SharePoint server (problem still occurred)
verified that their Excel Services account has the below permissions on the SQL Server Analysis Server (problem still occurred)

Resolution

When running the following commands to see the build level of SSAS, we found the problem:
$server = "serverInstance\PowerPivot"
$aso = New-Object Microsoft.AnalysisServices.Server
$aso.Connect($server)
Write-Host "The SSAS server version is: "$aso.Version

We saw that the SSAS (SQL Server Analysis Server) version is different in Staging than Production and it is working in Staging not in Production. The PowerPivot Add-in version is 11.0.3437 on the App servers in both Staging and Production. They had to update the SSAS instance on Production to the same (11.0.3437), it was previously at 11.0.3000.0

SharePoint 2010: cannot add user from a trusted domain to a site

Sal Rosales — Tue, 05 Jan 2016 17:21:08 GMT

Problem: customer could not locate any users from a specific trusted domain when using the people picker. there is 'No exact match was found'

Troubleshooting:

I verified that this command was run successfully:

stsadm -o getproperty -pn peoplepicker-searchadforests -url https://staging.contoso.net

did an IISRESET

still the user could not be found

Asked the customer to create a folder on the desktop of the server and try to add one of these users. The user was was NOT able to be added. This meant that this problem was a networking issue because if the user can't be added to a folder on the server desktop it certainly won't be available in IIS

Resolution

Ensure the proper ports are opened You must have ports opened between SharePoint and AD in order for both the UPA to function (389 or 636 or custom) and the People Picker to function. ?

ADDITIONAL INFORMATION

Ports:

TCP/UDP 135, 137, 138, 139 (RPC)

TCP/UDP 389 by default, customizable (LDAP)

TCP 636 by default, customizable (LDAP SSL)

TCP 3268 (LDAP GC)

TCP 3269 (LDAP GC SSL)

TCP/UDP 53 (DNS)

TCP/UDP 88 (Kerberos)

TCP/UDP 445 (Directory Services)

TCP/UDP 749 (Kerberos-Adm) [Opt.]

TCP port 750 (Kerberos-IV) [Opt.]

Recommended reading

People Picker Port/Protocol Requirements

URL: https://blogs.technet.com/b/wbaer/archive/2009/01/21/people-picker-port-protocol-requirements.aspx

SharePoint 2010-Multi domain and forest trust

URL: https://social.msdn.microsoft.com/Forums/office/en-US/c9f490c7-0597-4efd-8159-1df7019422bd/sharepoint-2010multi-domain-and-forest-trust?forum=sharepointadminprevious

Plan Security Hardening

URL: https://technet.microsoft.com/en-us/library/cc288143(v=office.14).aspx