UC Lobby https://docs.microsoft.com/archive/blogs/uclobby/feed.xml Wed, 05 Jun 2019 08:46:00 GMT en-US hourly 1 MS Teams Auditing for IT Pros - "Easymode" https://docs.microsoft.com/archive/blogs/uclobby/ms-teams-auditing-for-it-pros-easymode Thu, 24 Jan 2019 08:09:43 GMT https://blogs.technet.microsoft.com/uclobby/?p=9965 As you can see, I use 3 isolated channels within 1 single Team, as not to clutter one single channel too much with all operations in it. First of all, you should get the E-mail addresses for the channel(s) you create for this effect: Once you have that we can start with creating the actual Alert Policies: 1. Go Through the O365 Portal (https://portal.office.com/) 2. Access Admin -> Admin Centers -> Security & Compliance 3. In the Security & Compliance center go through the options 4. Search & Investigation -> Audit Log Search -> + New alert policy 5. Next we will customize the Alert for our needs 6. Make sure to paste the Channel E-mail address in the recipients. 7. Another important note is the scope of this Alert. In my example above, I created separate alerts, based on the activity scope, and channels. You’re all done! All that’s left is to save the policy and wait ~24 hours for it to be applied. The best thing about these logs is it will de-clutter your mailbox for sure with n need to stress it in case you have a huge company, without the need to set up Exchange Rules, folders for each type of audit, or the need to manually set up a new search. You can also customize the reports at your will. For example, have a channel for all user changes, another for all groups, other for channels, etc etc… 😊 All the best! Marco Carampanta]]> Restore deleted Teams and Channels from Microsoft Teams. https://docs.microsoft.com/archive/blogs/uclobby/restore-deleted-teams-and-channels-from-microsoft-teams Tue, 21 Aug 2018 14:16:48 GMT https://blogs.technet.microsoft.com/uclobby/?p=9725 Restore Deleted teams and channels from Microsoft Teams. In this article we will explain the steps needed to make use of the recent feature that allows us to recover deleted teams and channels from Microsoft Teams. Sometimes while we are managing our teams and channels around, accidentally we can remove an important team/channel, which can cause quite a negative impact, requiring us to take quick action to mitigate it in the most timely manner.   Restoring a deleted channel: This process is immediate, meaning there will be no replication time needed so the channel will be available to all members as soon as it is restored. Step 1. Manage the team where the deleted channel belonged    Step 2.             Access the channels listing, and the channel will show under the “Deleted” list   Step 3. Click the “Restore” option on the right-hand side of the screen   Step 4. Finally confirm the restoration via the promp:   Restoring a deleted Team: It’s important to understand that when you manage a Team under Microsoft Teams, you are directly affecting the Unified Office 365 Group, which originates from Exchange Online. To this effect, when you delete a Team within the Microsoft Teams application, you are effectively deleting the entire Office 365 Group (as well outlined in the warning message). This means that the restoration process will require replication between Office 365 services, which can take up to 24 hours to fulfill, however you can rest assured your messages, files, connectors, tabs, etc… will all be available.   Step 1. First of all you will have to access your Office 365 Admin Portal, then the Exchange Admin Center   Step 2. Access the Group listing, under the Recipients menu   Step 3. Confirm that the recently deleted team shows on the list and select it   Step 4. On the right-hand side menu, click the “Click here to restore” option   Step 5. Confirm the restoration request   Step 6. The group should appear as active immediately:   Step 7. Go back to the Office 365 Admin Portal and under the menu Groups then Groups again, confirm that the group is effectively showing up.   Step 8. Wait up to 24 hours for the replication to take place   Note, at the time of this writing, this restore procedure requires the ownership to be restored, so any new owners need to be removed, and the original owners (prior to deletion) must be restored.]]> Problems getting High-Resolution photos in Skype for Business with MA enabled https://docs.microsoft.com/archive/blogs/uclobby/problems-getting-high-resolution-photos-in-skype-for-business-with-ma-enabled Tue, 29 May 2018 14:28:02 GMT https://blogs.technet.microsoft.com/uclobby/?p=9535 Scenario:
  • Skype for Business Server 2015 and Skype for Business Online ("split domain" hybrid configuration)
  • Exchange 2013 and Exchange Online (Hybrid)
  • Skype for Business Online and Exchange Online Configured/Enabled for Modern Authentication (Mixed 5 topology)
      • Important to note, that, users may see multiple prompts in some cases, notably where the MA state is not the same across all the server resources that clients may need and request, as is the case with all versions of the Mixed topologies.  In some cases (Mixed 1, 3, and 5 specifically) an AllowADALForNonLynIndependentOfLync registry key must be set for proper configuration for Windows Desktop Clients.
  • All users hosted in Skype for Business On-Premises.
  • All users configured for Unified Contact Store(UCS)
 

Problem:

  • The users only have problems getting High-Resolution photos from the users contacts that have an Exchange mailbox On-Premises.
    • The users can only see the Low-Resolution Image Quality of the users contact photo.
  • The users don't have problems with High-Resolution photos from the users contacts that have an Exchange mailbox Online.
  Example of High-Res VS Low-Res: Photo credits to "Jeff Schertz" from: https://blog.schertz.name/2015/10/high-resolution-photos-in-skype-for-business/    

Solution:

  • There is a need to create two CsClientPolicies for the users with Exchange Mailbox On-premises and another for users with Exchange Mailbox Online.
    • Policy for users with Exchange Mailbox On-Premises:      PolicyEntry : {Name=AllowAdalForNonLyncIndependentOfLync;Value=False}
    • Policy for users with Exchange Mailbox Online:      PolicyEntry : {Name=AllowAdalForNonLyncIndependentOfLync;Value=True}
  • After implementing/granting the policies to the users, wait for replication to complete, and force the affected accounts to sign-out and sign-in for the settings to be properly applied.
  The setting "AllowAdalForNonLyncIndependentOfLync" can also be applied via REGKEYs. More details in the KB3082803.  

More Information:

The behaviour of the client on this setting “AllowAdalForNonLyncIndependentOfLync;Value=TRUE”
  • The Skype for Business Desktop or Lync 2013 clients will connect to Skype for Business Server by using NTLM or the Kerberos authentication protocol. Specifically, a user name and password or Windows Integrated Authentication will be required for a successful connection (as before).
  • After you sign in, Skype for Business or Lync 2013 will connect to Exchange Web Services (EWS). If the EWS service advertises OAuth settings (authorization URI), the client will use MFA. Additionally, if a credentials refresh is necessary, the user will be prompted through the modern authentication dialog box.
The behaviour of the client on this setting “AllowAdalForNonLyncIndependentOfLync;Value=FALSE”
  • The Skype for Business Desktop and Lync 2013 clients connect to Skype for Business Server by using NTLM or the Kerberos authentication protocol, a user name and password, or Windows Integrated Authentication.
  • After you sign in, Skype for Business or Lync 2013 connect to the user’s mailbox in Exchange Online by using Exchange Web Services (EWS). Although the EWS service advertises OAuth settings (the authorization URI), the client ignores this and falls back to a non-MFA sign-in by using an OrgID channel. This limits sign-in protocols to a user name and password or to Windows Integrated Authentication.
  Skype for Business topologies supported with Modern Authentication https://technet.microsoft.com/en-us/library/mt803262.aspx Configure the use of high-resolution photos in Skype for Business Server 2015 https://docs.microsoft.com/en-us/skypeforbusiness/deploy/integrate-with-exchange-server/high-resolution-photos Configure the use of high-resolution photos in Skype for Business Server 2015 https://technet.microsoft.com/en-us/library/jj688150.aspx Info about the AllowAdalForNonLyncIndependentOfLync setting in Skype for Business, Lync 2013, and Exchange Online https://support.microsoft.com/en-us/help/3082803/info-about-the-allowadalfornonlyncindependentoflync-setting-in-skype-f  ]]> Issue with Presence and IM on Federation when having a side-by-side tenant and Skype for Business on premises deployment https://docs.microsoft.com/archive/blogs/uclobby/issue-with-presence-and-im-on-federation-when-having-a-side-by-side-tenant-and-skype-for-business-on-premises-deployment Tue, 17 Apr 2018 21:22:16 GMT https://blogs.technet.microsoft.com/uclobby/?p=9555 is tied up with tenants being part of the communication path between the two organizations. Usually, there is a tendency to ignore the presence of an Office 365 tenant, when it is an important piece of the puzzle. When a given organization has a side by side tenant and Skype for Business on Premises deployment with a certain form of Federation, which are not set to Hybrid, it should raise a flag. Most often, in terms of user experience, the presence state of the Callee (Destination user) might be “Presence Unknown” / “Offline”, and instant messages cannot be delivered at all. Why does it happen? Whenever a Skype for Business Online homed user initiates Presence or IM requests to another user (For example, SUBSCRIBE request to retrieve a user’s presence state), it will go through a certain path, which will hit Skype for Business Online servers first. If, by any chance, this request will hit an existing Skype for Business Online homed user (The Callee, aka the destination) it will stop there. It might never reach your Edge servers, and therefore your Skype for Business On Premises homed user will not get the message, or your On Premises Front End server will not get the presence SUBSCRIBE request. There are multiple reasons for having such a situation. The most common ones point to users which are actively enabled for Skype for Business Online, users which were previously enabled but their Skype for Business Online license plans were disabled, and even users which were enabled for Microsoft Teams starting January 2018 (Due to a change related with Skype for Business Interop with Teams). Hence, this issue applies to those users who have a corresponding and matching account on both Skype for Business on Premises and Skype for Business Online, whereas usually the active account is homed On Premises, and the Skype for Business Online account is not needed yet (If at all). Below is a diagram which demonstrates the difference between a supported and non-supported scenario: How do we resolve this issue? The supported and recommended way to resolve this issue is simply to have a proper Skype for Business Hybrid deployment in place for all federated parties involved. This is required only in case the situation described above applies to at least one of them. An organization that has either Pure Skype for Business Online (No Skype for Business on Premises deployment in place) or Pure Skype for Business On Premises deployment (With no Office 365 tenant that holds the same SIP Domain\s as the On Premises has) does not require setting Hybrid. For more information on setting Skype for Business Hybrid properly, please refer to Microsoft Docs articles on this topic: So why going for Skype for Business Hybrid?
  • This is the supported configuration by Microsoft.
  • Having a properly deployed and managed Skype for Business Hybrid deployment will prevent the reoccurrence of this issue in the future. In this scenario, all other tenants will be aware that your tenant is Hybrid and not purely Online. Moreover, if users are managed following the guidelines of Skype for Business Hybrid deployment, confusion will be prevented and for each user there will be a definitive indication of its location (Whether it is homed On Premises or Online).
  • Having Skype for Business Hybrid will grant you the flexibility to decide where to home your Skype for Business users, hence you will be able to enjoy both worlds of Skype for Business Online and On Premises. You can migrate users from on premises to online at your own pace.
 How to identify this issue is affecting me? The most important piece of information is to identify if you and/or your federated partner have a side by side Office 365 tenant and a Skype for Business on premises deployment. As stated, this is the flag raised to go Hybrid, the sooner the better. Since having a Side by Side deployment, as described previously in this document, is not supported, the following golden rule applies: If it works, it does not necessarily mean it is supported. So, in our case here, the fact that users were not enabled for Skype for Business Online and are not affected by this issue, for whatever reason, does not mean we are in a supported state, and there is a risk this issue would surface. You can find possible evidence using a few methods, but the best option on the table still stands: Go Hybrid! If you still wish to get a notion about what is going on your tenant, you can use the following methods to retrieve some useful information:
  1. You can use Snooper (Skype for Business Debugging Tools) to analyze the Uccapi logs of a user which had this issue while trying to subscribe for another user’s presence state or to send an IM but failed. The error messages vary from one scenario to another, but they can become useful from time to time. For example, when a user is not actively enabled for Skype for Business Online, but still exists and classified as “Disabled”, the following might appear (Note, there is no single univalent error code, each scenario might have different behavior):
ms-diagnostics: 4049;reason="Target is disabled";processing-cluster="sippoolXYZ.infra.lync.com";processing-frontend="FEXYZ.infra.lync.com";target-user-primary-pool=" sippoolXYZ.infra.lync.com";source=" FEXYZ.infra.lync.com"
  1. You can use Get-CsOnlineUser or Get-AzureADUser to retrieve a list of users and\or a given user details from your tenant.
One way is to use the Get-CsOnlineUser cmdlet of Skype for Business Online PowerShell to retrieve information about a user which is suspected to be homed online. If you wish to list all users which are homed on Skype for business online, the following queries can be used:
  1. Get-CsOnlineUser -Filter {HostingProvider -like "sipfed.online.lync.com"} | Select-Object UserPrincipalName,SipAddress,DisplayName
  2. (Get-CsOnlineUser -Filter {HostingProvider -like "sipfed.online.lync.com"} | Select-Object UserPrincipalName,SipAddress,DisplayName).count
  3. Get-CsOnlineUser | Select-Object UserPrincipalName,SipAddress,DisplayName
  4. (Get-CsOnlineUser | Select-Object UserPrincipalName,SipAddress,DisplayName).count
  5. Get-CsOnlineUser -Identity username | select HostingProvider, SIPProxyAddress | fl
Also, you can use Azure AD PowerShell Module and run the following cmdlet. A possible result, for example, would be for a user which was never licensed should return an empty result: Get-AzureADUser -SearchString Username | select SIPProxyAddress Important Note: While going Hybrid with Skype for Business, please take into consideration the following: Once you have set the SharedSipAddressSpace parameter to $True on a given tenant, it will apply to all SIP Domains which are registered and verified under this Office 365 tenant. In other words, when setting a tenant to be Hybrid all other SIP Domain registered under the same tenant are considered hybrid as well. The reason for that is related to the fact the that tenant's SharedSipAddressSpace setting is global for the whole tenant and not exclusive for a single SIP Domain. Each SIP Domain you would like to utilize for Skype for Business under this tenant will have to be deployed as it was Hybrid, on the same single on-premises topology of Skype for Business Server used up to this point. For more information: https://support.microsoft.com/en-sg/help/3124484/skype-for-business-online-users-in-an-office-365-domain-can-t-im-or-de https://docs.microsoft.com/en-gb/skypeforbusiness/skype-for-business-hybrid-solutions/plan-hybrid-connectivity  ]]> "Cannot find the location of the Central Management Store in Active Directory" error on your Skype For Business Pool https://docs.microsoft.com/archive/blogs/uclobby/cannot-find-the-location-of-the-central-management-store-in-active-directory-error-on-your-skype-for-business-pool Fri, 26 Jan 2018 17:51:45 GMT https://blogs.technet.microsoft.com/uclobby/?p=9405 You can confirm this by connecting to your DC and navigate to the Topology Settings using ADSI Edit. If the Topology Settings folder has no data, our issue is confirmed. In order to resolve this problem, you will have to execute the two following commands: Set-CsManagementConnection -StoreProvider Sql -Connection <your SQL Backend FQDN> Set-CsConfigurationStoreLocation -SqlServerFqdn <your SQL Backend FQDN> After doing so you'll see the Get commands will be restored successfully, and the topology settings will be restored on AD.   Notice that this is meant to do for backends configured on its default instance. If you have a named custom instance, the paths on the commands shared could slightly change.]]> Skype for Business Client with "Outlook Integration Error" for around 10/15 minutes https://docs.microsoft.com/archive/blogs/uclobby/skype-for-business-client-with-outlook-integration-error-for-around-1015-minutes Tue, 16 Jan 2018 17:14:10 GMT https://blogs.technet.microsoft.com/uclobby/?p=9356 Scenario:
  • Skype for Business client 2015/2016 (MSI or Click to Run)
  • Skype for Business client April 2017 update (or higher)
  • Exchange Server 2010

Problem:

  • When opening the Skype for Business client you get in bottom right corner an exclamation mark, for around 10/15 minutes, with the following error: "Outlook Integration Error".
  • You open the "Configuration Information", and you see the MAPI and EWS with OK status.
  • All Free/Busy features are working fine, no problems are reported.
  • After waiting around 10/15 minutes, the exclamation mark disappear from the Skype for Business client and everything remains working.
  • The root cause for this problem, is that the client tries to create the "Skype for Business Contacts" folder in the user exchange mailbox and fails.                                               
  • This problem only affects users with mailboxes hosted in Exchange Server 2010 with Skype for Business client April 2017 update (or higher). This update deprecates the "Skype for Business Contacts" folder in Outlook and Outlook Web App.
  • Additional details can be found in the following article:

Deprecation of "Skype for Business Contacts" folder in Outlook and Outlook Web App https://support.microsoft.com/kb/4015948

Solution:

  • Option 1:

    • Migrate the user’s mailboxes to a higher Exchange Server version (2013/2016).

  • Option 2:

    • Disable the creation of the "Skype for Business Contacts" folder.
      • Below is the list of cmdlets to create a new Policy and assign it only toa single user for test proposes:

New-CsClientPolicy -Identity ContactsDeprecation -EnableExchangeContactSync $false $x = New-CsClientPolicyEntry -Name "EnableExchangeContactsFolder" -Value "$false" Set-CsClientPolicy -Identity ContactsDeprecation -PolicyEntry @{Add=$x} Grant-CsClientPolicy -Identity sip:testaccount@contoso.com -PolicyName ContactsDeprecation Invoke-CsManagementStoreReplication

      • Wait around 5 minutes, sign-out from the client and Outlook, and try again.
]]> Move users in Skype for Business Control Panel with MFA https://docs.microsoft.com/archive/blogs/uclobby/move-users-with-skype-for-business-control-panel-with-mfa Tue, 02 Jan 2018 15:53:28 GMT https://blogs.technet.microsoft.com/uclobby/?p=9226 Scenario:
  • Skype for Business Server 2015 (CU6)
  • Skype for Business Online, Windows PowerShell Module (Build: 6.0.9276.0)
  • Skype for Business Pool configured in Hybrid Mode
  • Skype for Business On-Premises administrator account has Multi-Factor Authentication(MFA) in Office 365

Problem:

  • When you have this setup, in Skype for Business Server 2015 Control Panel, you try to move users from On-Premises to Online or vice-versa, but you cannot authenticate with your administrative account in Office 365 services.
]]> Files from Office 365 groups aren’t visible in MS Teams (files are visible in actual Group) https://docs.microsoft.com/archive/blogs/uclobby/files-from-office-365-groups-arent-visible-in-ms-teams-files-are-visible-in-actual-group Wed, 27 Sep 2017 15:02:07 GMT https://blogs.technet.microsoft.com/uclobby/?p=8955 But aren´t visible on Team Action Plan Step 1 - Collect Fiddler for troubleshooting 1. Download and install Fiddler From here: https://www.telerik.com/download/fiddler . Launch it from the start menu then select Tools | Fiddler Options On the HTTPS tab, select Decrypt HTTPS traffic When prompted, Trust the Fiddler root CA and install the certificate when the subsequent prompt asks Ensure the Decode button on the toolbar is set: Close the Fiddler. 2. Reproduce the problem NOTE : When the customer is ready to reproduce the problem, please close any HTTP related service. Open Fiddler again. It will automatically start the capture. Confirm that the problem is reproduced. 3. Save the Fiddler trace (save -> all sessions) and send it along with the client logs (logs.txt). Step 2 - Analyze the issue Open Fiddler trace and do “Ctrl+F” and search for errorCode You will see a result 401 with the errorcode you need to analyze as we can see on this example. {"errorCode":"FirstPartyThirdPartyResourceUriConflicts","message":"AADSTS65001: The user or administrator has not consented to use the application with ID 'cc15fd57-2c6c-4117-a88c-83b1d56b4bbe' named 'Sharepoint'. Send an interactive authorization request for this user and resource.\n Alternatively, The APP ID URI https://DOMAIN.sharepoint.com for the App:'fd021f66-8821-42b2-bec2-396e921fb666' named 'Sharepoint' in the tenant 'AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEE' might be in conflict with the APP ID URI for the multitenant app 'sharepoint.com'. Update the registered APP ID URI for app 'fd021f66-8821-42b2-bec2-396e921fb666' to something else to avoid the conflict\r\nTrace ID: 76de0f04-be27-42f7-9d0e-fed8481c0900\r\nCorrelation ID: 252d4314-f94e-412c-9eb6-9e75289fe532\r\nTimestamp: 2017-09-14 14:11:30Z"} Resolution Go to • https://portal.azure.com • “Azure Active Directory” section • “App registrations” (under “MANAGE” section) • You can search by name or App ID. To search by name, you need as much as possible of the beginning of the name. So try “Sharepoint” • Once you find the Third Party app, click to open it. You’ll find “Home page” and “Reply URLs”. • Change those to *NOT* be “https://domain.sharepoint.com/” because that is used by SharePoint already. As an example “https://test/”]]> How to reboot your Lync/SfB Servers without breaking the Quorum. https://docs.microsoft.com/archive/blogs/uclobby/how-to-reboot-your-sfb-servers-without-breaking-the-quorum Tue, 26 Sep 2017 10:51:54 GMT https://blogs.technet.microsoft.com/uclobby/?p=8905 our Technet Article about High Availability. There, you will find what's the minimum servers that must be up to have a healthy pool, as well as many other interesting information. If those requirements are not met, it's not possible to mantain the quorum functioning as expected. Checked the requirements, this is the reccomended way to reboot a server in a pool.
  1. First, check that the Pool Fabric State is healthy before doing anything by running Get-CsPoolFabricState -PoolFQDN <PoolName> If the servers show as OK and UP status, and no warnings are shown, you're good to go.
  2. Check the Upgrade Readiness State with Get-CsPoolUpgradeReadinessState. If the pool is in Ready State and the Front-End shows TRUE on the "IsReadyForUpgrade" tab, you're ready to proceed.
  3. Stop the services on this server gracefully. To do so, use Stop-CsWindowsService –Graceful
  4. Now that the services are stopped, run Get-CsPoolFabricState. You will receive a set of warnings, but the important thing is here is that a the bottom of the output, all servers except the one where you're working are OK and in UP Status.
  5. Checked this, you can go on with the Reboot and wait until the services are again up and running.
Repeat steps  1 - 5 with all servers in the pool if you need to reboot them all. I hope you found this information useful, and hope to see you next time around!]]> Exchange Mailbox requirements for MS Teams and Troubleshooting https://docs.microsoft.com/archive/blogs/uclobby/exchange-mailbox-requirements-for-ms-teams-and-troubleshooting Fri, 08 Sep 2017 13:29:47 GMT https://blogs.technet.microsoft.com/uclobby/?p=8845 Exchange Mailbox Location The ideal state is for all Skype Teams users to have their mailboxes homed on Exchange Online. The minimum state for users to use Skype Teams are Exchange mailboxes on-premises with their identities synchronized to Office 365. For these Exchange hybrid customers, note that Meetings, Changing Profile Photo, and Connectors are not available if user's mailbox is hosted on-premises or in legacy Dedicated online (Azure ADSync required) and there are no current plans to fix this. Root cause is that is not possible yet connect to user´s mailbox using Exchange API's. However, as long as one IT Pro / user can add Connectors for a given team, the rest of the team members can have Exchange mailboxes homed on-premises with their identities synchronized to Office 365.  Exchange mailbox enabled ('online' or 'on-premises + directory sync') is required.  
Actions supported:              
User's mailbox is hosted in: Create teams Join teams Create channels Create and view meetings Modify User Profile Picture Add and configure connectors Add and configure tabs Add and configure bots
Exchange Online Yes Yes Yes Yes Yes Yes Yes Yes
Exchange Online Dedicated vNext Yes Yes Yes Yes Yes Yes Yes Yes
Exchange Online Dedicated – Legacy (Sync to Azure AD required) Yes Yes Yes No No No Yes Yes
Exchange on-premises (Sync to Azure AD required) Yes Yes Yes No No No Yes Yes
    Group Creation Enablement Group Creation needs to be enabled as a feature under Exchange (it is on by default for everyone) so that groups can be created by anyone.  Administrators can limit the users who can create groups through updating MSOL settings in Powershell and narrow down to a specific security group.   Azure Active Directory Connect for Hybrid Users All O365 subscribers are assigned a free license by default for Azure Active Directory.  In the case where tenant have users' mailboxes homed on-premises, they must go through O365 Directory synchronization to either: -          Synchronize Identities Synchronize on-premises directory objects with Office 365 and manage your users on-premises. You can also synchronize passwords so that the users have the same password on-premises and in the cloud, but they will have to sign in again to use Office 365. -          Federate Identities Synchronize on-premises directory objects with Office 365 and manage your users on-premises. The users have the same password on-premises and in the cloud, and they do not have to sign in again to use Office 365. This is often referred to as single sign-on.   We have a FAQ for that topic which you can find on this Admin support page.     Troubleshooting How to collect Web app and Desktop logs? -          Windows
  • Web logs
    • Press (CTRL+ALT+SHFT+1) in client to download logs
    • %downloads%\MSTeams Diagnostics Log <timestamp>.txt
Best logs to start with Contains most all client activity
  • Desktop logs
    • %appdata%\Microsoft\Teams\logs.txt
Contains framework and bootstrapping info App Bootstrap process Plugin initialization Update Management Some SSO info when using SSO builds (Desktop Auth) -          MAC
  • Web logs
    • Press (Command+Option+SHFT+1) in client to download logs
    • Downloads\MSTeams Diagnostics Log <timestamp>.txt
Best logs to start with Contains most all client activity
  • Desktop logs
    • ~/Library/Application Support/Microsoft/Teams/logs.txt
Contains framework and bootstrapping info App Bootstrap process Plugin initialization Update Management Some SSO info when using SSO builds (Desktop Auth)   How to collect from Exchange side ? -          The Unified Audit logs feature in the Security and Compliance Center can be utilized to search audit logs for Microsoft teams. Please note that it may take up to 24 hours before the activity is seen in the Unified Audit Log. -          Using PowerShell you can certainly use the Search-UnifiedAuditLog cmdlet and specify the -RecordType as MicrosoftTeams -          The following article articulates the supported audited activities for Microsoft Teams : Search the audit log in the Office 365 Security & Compliance Center -          There isn’t any special audit setting that needs to be turned on at the mailbox level for this activity. Mailbox auditing is only supported for mailboxes of type UserMailbox -          Please note that even though there is a mailbox for the team, it is same as a modern group mailbox, meaning the user associated with the mailbox is a group object (not a user object). Following is an example:   PS C:\Temp> Get-Mailbox -GroupMailbox MSContoso_abc |fl DisplayName,RecipientType*,Audit*   DisplayName          : MSContoso RecipientType        : MailUniversalDistributionGroup RecipientTypeDetails : GroupMailbox AuditEnabled         : False AuditLogAgeLimit     : 90.00:00:00 AuditAdmin           : {Update, Move, MoveToDeletedItems, SoftDelete...} AuditDelegate        : {Update, SoftDelete, HardDelete, SendAs...} AuditOwner           : {}   -          By design you cannot runs cmdlets such as the following. It will simply error out. Get-Mailbox -GroupMailbox GroupMailbox MSContoso_abc | Set-Mailbox -AuditEnabled $true The set-mailbox cmdlet cannot work against this type of mailboxes and hence the AuditLogAgeLimit cannot be increased. ]]>