Tim D'Annecy

exchange

#Exchange #PowerShell

I received a request from a client that was struggling with using Shared Mailboxes in Exchange Online. They wanted to be able to see all sent email messages in the Shared Mailbox “Sent” folder instead of the user's email address.

For example:

  1. A user has “Send As” permissions on a Shared Mailbox named “Finance@example.com”.
  2. The user composes a new email in Outlook and changes the “From” setting to “Finance@” and clicks the Send button.
  3. The email is delivered to recipients from “Finance@”.
  4. A copy of the sent email is stored in the user's “Sent” folder.

The issue with this process is that there is no record inside the Shared Mailbox that an email was sent from the account. Only the original sender has a copy of the message, but other users who have access to the Shared Mailbox cannot see which email messages have been sent out or which items in the inbox have been replied to.

To fix this issue, I wrote a quick PowerShell script to update all Shared Mailboxes with 2 attributes.

Read more...

#PowerShell #Exchange #M365

Similar to my post yesterday to get all SharePoint Sites for a user, I received another request today to generate a report of all Shared Mailboxes that a user has access to in Exchange Online.

Right now, there's no ability in the Exchange Admin center to list all Shared Mailboxes that a user can access.

To work around this limitation, I wrote a simple PowerShell script to get all Shared Mailboxes, check if the specified user has permissions, then output the report to a .csv file.

Read more...

#Azure #DNS #security #Exchange

Your organization may have a primary domain that's used for sending and receiving email (e.g. bill@company.com), but you may also have other domains that aren't used for email routing (company.net, companywebsite.com). You or another administrator may have setup SPF, DMARC, and DKIM records for these externally facing domains that handle email, but there is still a risk of email spoofing attacks on your non-sending domains.

Without SPF, DMARC, and DKIM records in your DNS, there's a potential for anyone to send email as if it comes from your domain. This can cause you a huge headache as an administrator to clean up and organizations can lose brand trust from customers if they receive these emails.

To prevent this spoofing attack, all you need to do is add 3 records to your DNS config for each domain. These records are used by the recipient's email server to verify whether the sender is authenticated to use the domain. If the record check fails, the message is rejected and the recipient doesn't receive the email.

Read more...

#Exchange #AzureAD #security

Microsoft has announced several times that they are depreciating Basic Authentication for Exchange Online soon, possibly this month (January 2023).

A recent post has information about the deprecation and how to prepare for it.

I wanted to write down how to identify any Basic Authentication usage in your environment from that post and simplify it to just a few clicks. This is a good way to identify any applications that are using Basic Authentication and need to be updated before they get blocked.

Read more...

#Exchange #Powershell #Windows

I recently had a request to spin up an on-prem Exchange 2016 server and connect it with a new Azure AD tenant and Exchange Online. I created a new Azure VM with Server 2016 and ran the latest patches and Windows updates before installing anything.

After going through the regular Exchange server setup process and installing Azure AD connect on the Domain Controller, I needed to install and run the Exchange Hybrid Configuration Wizard on the Exchange server.

After running the install, I ran into an error that would not let me continue:

Failed Setup terminiated with an Exit Code 1603

To work through this, I found a post [A] that details some changes that need to be made in the registry relating to the TLS

I wrote up this quick script so that it can be run quickly without mucking through regedit:

Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727' -Name 'SystemDefaultTlsVersions' -PropertyType dword -Value 1
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727' -Name 'SchUseStrongCrypto' -PropertyType dword -Value 1
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727' -Name 'SystemDefaultTlsVersions' -PropertyType dword -Value 1
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727' -Name 'SchUseStrongCrypto' -PropertyType dword -Value 1
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SystemDefaultTlsVersions' -PropertyType dword -Value 1
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -PropertyType dword -Value 1
Set-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Name 'SystemDefaultTlsVersions' -PropertyType dword -Value 1
Set-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -PropertyType dword -Value 1
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Name 'DisabledByDefault' -PropertyType dword -value 0
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Name 'DisabledByDefault' -PropertyType dword -value 0
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Name 'Enabled' -PropertyType dword -value 1
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Name 'Enabled' -PropertyType dword -value 1

Discuss...

#Azure #Exchange

A company I work with requested a deployment of RedCap, a web application for building and managing online surveys and databases, into their Azure environment.

Currently, the official RedCap documentation is incomplete and has inaccurate instructions on some of the Azure steps.

While I got this rolled out for the company, I decided to take detailed notes to help others in deploying this in Azure. This process is detailing my environment, running REDCap 12.5.4, PHP 7.4.28 (Windows OS), MySQL 5.7.32

Deployment

To start, you'll need the following credentials:

  • Global Administrator access to your Azure tenant or the ability to create AppService Plans and roll out Templates
  • Exchange Administrator
  • Admin access to your public DNS provider
  • RedCap Community site access

Begin by opening your browser and navigating to the official RedCap GitHub fork for the Azure Template: https://github.com/vanderbilt-redcap/redcap-azure

Click on the link in the README page with the text “Deploy with your SMTP Relay” to open the Azure Template page and begin deployment:

Screenshot of RedCap Azure Template on Github

  • Subscription: Choose your organization's subscription
  • Resource group: Create new to keep things organized
  • Region: Choose the region closest to the usage location
  • Site Name: Something with “Redcap” to keep it organized
  • Administrator Login: Keep the default of redcap_app
  • Administrator Login Password: Set to a strong password
  • Redcap Community Username and Password: Copy and paste this from your welcome email from RedCap after purchasing a license. If this information is not correct, the Template deployment will fail because it won't be able to download the RedCap installation.
  • Redcap App Zip Version: latest
  • From Email Address: Create an Shared Mailbox in Exchange and put it here like redcap@domain.com. Login to the Microsoft Admin center and reset the password for that RedCap Shared Mailbox as a User object.
  • Smtp FQDN: smtp.office365.com
  • Smtp User and password: redcap@domain.com
  • Smtp Port: 587
  • Sku Name: S1
  • Sku Capacity: 1
  • Database Sku Size MB: 5120
  • Database For My Sql Tier: General Purpose
  • Database For My Sql Family: Gen5
  • Database For My Sql Cores: 2
  • Mysql Version: 5.7
  • Storage Type: Standard_LRS
  • Storage Container Name: redcap
  • Repo URL: https://github.com/vanderbilt-redcap/redcap-azure.git
  • Branch: master

Screenshot of Azure Template deployment for RedCap

You can adjust the size of your AppService after deployment, so leave the Sku options default.

After inputting your data, deploy it and wait about 30 minutes for everything to provision and install.

I had some issues with the deployment, specifically the clean up tasks at the end. These can be ignored. You should have a working install if the following items were created successfully:

  • AppService Plan
  • AppService
  • Azure Database for MySQL single server
  • Storage Account

Screenshot of Azure Portal showing the RedCap Resource Group after template deployment

After deploying, there are quite a few things you'll need to fix before rollout.

You should be able to open the newly deployed RedCap app in the Azure Portal by navigating to your Resource Group and clicking on the RedCap AppService. On the Overview blade, click on the “Browse” button:

Screenshot of Azure App Service, Overview blade

You should be able to open the app with no authentication.

Click on the Control Center button at the top of the page and click on Configuration Check on the left pane to begin working through the many issues displayed on this page.

Fixing cron process

For some reason, the scheduled tasks performed by the cron process are not running as expected after deployment. This impacts regular server tasks like database cleanup and sending emails.

To work around this issue, you'll need to create a manual job in the App Service that forces the process to start. This manual job has two files: a PowerShell script that calls PHP and cron, and a cron file that sets a schedule for auto-running the app every minute. Since RedCap was created using an Azure Template, we won't be able to use the built in portal GUI since Azure wants to keep the git repository in sync that we used in the Template. We will need to create this process manually, but the task is configurable inside the Azure Portal after creation.

To start, open the Azure App Service page for your newly deployed app and navigate to the “Advanced Tools” blade. This opens a tool called Kudu.

From the Kudu dashboard, navigate to Debug console > PowerShell.

Screenshot of Kudu in Azure, Debug console, PowerShell

In this browser, navigate to /site/wwwroot and click on the Plus icon and select “New folder”.

Create all folders until you have the following structure: C:\home\site\wwwroot\App_Data\jobs\triggered\Start-CronService

Screenshot of Kudu in Azure, Debug console, new folder option

Create a file in that location and name it Start-CronService.ps1. Click on the pencil/edit icon and paste in the following PowerShell command:

# Start-CronService.ps1
# Tim D'Annecy - 2022-08-04
# Starts the cron PHP service
# Should be deployed to C:\home\site\wwwroot\App_Data\jobs\triggered\Start-CronService\Start-CronService.ps1
# Had to hard code URIs for some reason... Working with RedCap 12.5.1

function Start-CronService {
    $cronFile = 'C:\home\site\wwwroot\cron.php'
    $phpExe = 'C:\Program Files (x86)\PHP\v7.4\php.exe'

    Start-Process -NoNewWindow -FilePath $phpExe -ArgumentList $cronFile
}
Start-CronService

In that same folder, create a file titled settings.job and paste in the following code:

{
  "schedule": "0 */1 * * * *",
}

After creating these files, you should have the following items in your folder at C:\home\site\wwwroot\App_Data\jobs\triggered\Start-CronService:

Screenshot of Kudu in Azure, Debug console, PowerShell, File view

After saving, restart your AppService from the “Overview” blade. You will see this task appear from the AppService page under the WebJobs blade:

Screenshot of Azure portal, AppService page, WebJobs blade

You can check the status by viewing logs logs and stop/start the process, as needed.

Subdomain and HTTPS connection

At this point, your app is reachable over HTTP with the long name of blah.azurewebsites.com. It's better to use a subdomain like redcap.domain.com and to force users to access the site over HTTPS.

To accomplish both of these, you'll need to make a few changes in your DNS hosting provider, in the Azure environment, and inside the RedCap AppService.

To begin, navigate to the Azure Portal and open up your AppService for RedCap. Click on the “Custom domains” blade and change HTTPS Only to On. After this is enabled, you can add your custom subdomain.

Click the “Add custom domain” button and fill in the subdomain that you want to use. For this example, I'm using redcap.domain.com

After opening the “Add custom domain” configuration pane, open a tab for your DNS provider. The company I'm working with uses Oracle DynDNS.

From the custom domain configuration pane in Azure, you'll copy and paste the following values into your DNS provider:

  1. From “Custom Domain Verification ID” in Azure into a TXT record in DNS for asuid.redcap.domain.com.
  2. From CNAME in Azure into a CNAME record in DNS for redcap.domain.com

Screenshot of Azure AppService DNS settings and Oracle DynDNS

Once these are in place, you'll create a certificate in Azure to secure the web connection for HTTPS traffic.

Open the “Certificates (preview)” blade. Click “Add certificate”. Set the Source to “Create App Service Managed Certificate” and type in your subdomain from earlier (redcap.domain.com). The “Certificate friendly name” can be set to something more readable, if you like. Change the SSL binding to a “SNI SSL” and deploy it:

Screenshot of Azure AppService Certificates

Once this certificate is deployed, switch back to the “Custom Domains” blade. You should see your subdomain populated as “Secure”. You should be able to load your site over an HTTPS connection and your certificate will be valid. You may need to wait a little bit for DNS and the certificate to propogate.

After making this change in Azure, navigate back to your RedCap instance and open Control Center > General Configuration and change the “REDCap base URL” to your subdomain (e.g. https://redcap.domain.com).

Screenshot of RedCap General Configuration page

Azure AD single-sign on

This piece is very finicky. If you make an error in setting the SSO settings inside Redcap, you can get locked out of your instance. If this happens, you can use a SQL query on your to get back in:

UPDATE `redcap_config` SET `value`='none' WHERE `field_name`='auth_meth_global' LIMIT 1

Navigate back to your AppService for RedCap and click on the “Authentication” blade. Click “Add an identity provider”.

In the wizard, on the Basics tab, change the Identity Provider to Microsoft and change the “App registration type” to Create new app registration. Give it a name like “RedCap”. Change the “Supported account types” to Any Azure AD directory - Multi-tenant. Leave the other fields as default.

Azure AppService Authentication Add an identity provider, Basics tab

On the Permissions tab, keep the default value for User.Read:

Azure AppService Authentication Add an identity provider, Permissions tab

After adding the identity provider, return to the Authentication page. Click on the Pencil icon next to your new Authentication provider.

On the “Edit identity provider” page, copy the Application (client) ID.

Open your RedCap instance and navigate to Control Center > Security & Authentication and change the “Authentication Method” to Azure AD OAuth2. Scroll down the page and paste this Application ID into the “Azure AD API Client ID” field:

Screenshot of RedCap Azure AD OAuth2 and Azure AppService identity provider configuration

Click on Client secret value. It will redirect you to the AppService Configuration blade. Copy the value of the MICROSOFT_PROVIDER_AUTHENTICATION_SECRET into the RedCap field for Azure AD API Client Secret:

Screenshot of RedCap Azure AD OAuth2 and Azure AppService identity provider configuration

Set your RedCap@domain.com account or yourself as a Primary and/or Secondary Admin and click “Save”.

You might need to save this value twice, RedCap may reload the page without saving the values. After saving, you will need to set some values in Azure AD to handle post-login behavior.

Navigate to the Azure AD portal

Navigate to the “App registrations” blade and click on the RedCap application you named earlier. Open the “Authentication” blade.

Under the “Web” section, you'll need to add the following two URLs to your instance for the URL callback: * https://redcap.domain.com/.auth/login/aad/callback * https://redcapFULLNAME.azurewebsites.net/.auth/login/aad/callback

Under “Select the tokens you would like...” to be set to ID tokens (used for implicit and hybrid flows)

Screenshot of Azure AD App Registration for Redcap, Authentication blade

After that, navigate to the “API permissions” blade and click “Add a permission”. Select Microsoft Graph > Delegated permissions. Add the following items and save :

  • OpenID permissions
    • email – View users' email address
    • openid – Sign users in
    • profile – View users' basic profile
    • User.Read – Sign in and read user profile

Screenshot of Azure Registered Apps, API permissions page

After making these changes, try accessing your domain at https://redcap.domain.com.

If you can successfully login, you'll get this error on the page Control Center > Configuration Check:

Screenshot of RedCap, site_admin error

“siteadmin” user should not be an Administrator! It appears that the user “siteadmin” is an Administrator. However, this user account should ONLY ever be an Administrator when the system-level authentication method is set to None (Public), otherwise this user should NOT be an Administrator. You should go to the “Administrators & Acct Managers' page and remove them as an Administrator immediately, otherwise users accessing public REDCap projects may gain access to things that only REDCap Administrators should be accessing.

The instructions in this error are not accurate to the current version of RedCap. To make this error disappear, navigate to the Control Center > Administrator Privileges and uncheck all of the permissions for the user:

Screenshot of RedCap, user permissions

After that's cleaned up, you can suspend the account on the Control Center > Browse Users > View list by criteria page. Click the “Display user list” button and select the site_admin account. Check the box next to the account and suspend it using the button on the bottom:

Screenshot of Redcap, Browse Users

Do not delete this user. On a reboot of the AppService, RedCap will check to make sure this user is still present and show a database error if it's missing.

Cleaning up

After you've made these changes, you can delete some items out of the Configuration page in the AppService blade, as recommended by RedCap documentation, but there's no real reason to do so.

MySQL database changes

RedCap will give you a warning about the default MySQL database configuration:

RedCap MySQL warning message

Your database configuration settings do not appear to be optimal. For better database performance and stability, consider making the changes below to your database configuration settings in your my.cnf (Linux/Unix) or my.ini (Windows) configuration file. TIP: Remember to restart the MySQL service after making any edits to the configuration, otherwise they won't take effect.

Navigate to the Azure Portal and open up the SQL object that was created with the Template deployment. Navigate to the Query Performance Insight blade. From here, click on the top banner:

Screenshot of Azure MySQL Query Performance Insite message

Change the following options and save: * query_store_capture_mode = ALL * query_store_capture_utility_queries = YES

Screenshot of Azure MySQL server parameters

Over time, Azure should make recommendations to adjust your SQL configuration to be more efficient.

User-uploaded document store

After first install and logging in with an admin account, RedCap will give an error about the user-uploaded documents:

RedCap user-uploaded documents error message

Directory that stores user-uploaded documents is exposed to the web: It is HIGHLY recommended that you change your location where user-uploaded files are stored. Currently, they are being stored in REDCap's “edocs” directory, which is the default location and is completely accessible to the web. Although it is extremely unlikely that anyone could successfully retrieve a file from that location on the server via the web, it is still a potential security risk, especially if the documents contain sensitive information. It is recommend that you go to the File Upload Settings page in the Control Center and set a new path for your user-uploaded documents (i.e. “Enable alternate internal storage of uploaded files rather than default 'edocs' folder”), and set it to a path on your web server that is NOT accessible from the web. Once you have changed that value, go to the 'edocs' directory and copy all existing files in that folder to the new location you just set.

You can fix this by navigating to the Control Center and opening the “File Upload Settings” page. From here, change the dropdown to Microsoft Azure Blob Storage and scroll down to the section with the same title.

Open another browser tab and navigate back to your Resource Group that you setup in Azure. Open the Storage account for the app and copy and paste the Storage account name and the blob container name:

Screenshot of Azure Storage account and RedCap File Upload Settings pages

In the Azure tab, open the Access keys blade and copy and paste the Key from Key1 in the RedCap configuration page:

Screenshot of Azure Storage account and RedCap File Upload Settings pages

Save the changes at the bottom of the page, then confirm this worked by opening the Control Center and clicking on Configuration Check.

SMTP settings

The company I'm working with is using Exchange Online for its email service. To make things easy with Redcap, I created a Shared Mailbox of “RedCap@domain.com” and set a password on the Microsoft 365 Admin dashboard.

After a fresh install of RedCap 12.5.4, the SMTP settings I set in the Template did not work:

RedCap SMTP email error message

REDCap is not able to send emails – CRITICAL: It appears that your SMTP configuration (email-sending functionality) is either not set up or not configured correctly on the web server. It is HIGHLY recommended that you configure your email/SMTP server correctly in your web server's PHP.INI configuration file or else emails will not be able to be sent out from REDCap. REDCap requires email-sending capabilities for many vital application functions. For more details on configuring email-sending capabilities on your web server, visit PHP's mail configuration page.

To fix this, you'll need to open Control Center > General Settings. Scroll down to the “Configuration for Outgoing Emails” section and set the Universal FROM Email address as your redcap@domain.com email. Also set this same email under Other system settings under Email Address of REDCap Administrator.

After you update the config, you'll also need to update the version of SendMail. The one bundled with RedCap 12.5.4 does not work with TLS 1.2 and needs to be updated. To do this, we'll push the files to the AppService using FTPS.

Start by opening the GitHub page for Sendmail with TLS 1.2: https://github.com/sendmail-tls1-2/main . Download the Sendmail_v33_TLS1_2.zip file and unzip the files on your computer.

Edit the file settings.ini and put in the SMTP settings you set earlier during the deployment step, be sure to change these values to your environment:

  • smtp_server=smtp.office365.com
  • smtp_port=587
  • smtp_ssl=auto
  • auth_username=redcap@domain.com
  • auth_password=XXX
  • force_sender=redcap@domain.com
  • hostname=domain.dom

After making the changes to the file, save and close it. Now, you'll upload the patched Sendmail with the changed .ini file into your AppService using FTPS.

Navigate to the Azure Portal and open your RedCap AppService. Click on the “Deployment center” blade. Click on the “FTPS credentials” tab.

Download FileZilla or another application that can connect to an SFTP endpoint. For this example, I'll be using FileZilla.

Open the app and add a new site. Copy the connection information from the AppService FTPS credentials page into FileZilla:

Screenshot of Filzilla and Azure AppService, setting up a New Site wizard

Once you've connected to the FTPS endpoint, use the left pane to find the new Sendmail folder that you unzipped on your local computer. Navigate on the right pane to the location C:\home\site\repository\Files\sendmail. Select and right click on all of the files in the Sendmail folder in the local view and click “Upload”, overwriting all files.

Screenshot of Filzilla connected to Azure FTPS endpoint in AppService

After this is complete, restart your AppService for the patched changes to take effect.

If your organization is using Azure AD's Security Defaults, you will need to allow the redcap@domain.com account to use basic authentication to login.

To do this, open Azure AD Conditional Access policies and allow basic authentication for your redcap@domain.com account, or add an exception:

Screenshot of Azure AD Conditional Access policies, adding an exception

You will also need to create a Rule inside Exchange Online to allow emails to go through without being tagged as Spam. To do this, open the Exchange Admin center and navigate to Mail flow > Rules. Create a new rule with the following properties:

  • Name: Allow RedCap emails
  • If the message... Includes these words in the sender's address: 'redcap'
  • Do the following... Set the spam confidence level (SCL) to '-1'
  • Rule mode Enforce
  • Additional properties Sender address matches: Header

Screenshot of Exchange Online, Mail Flow > Rules, new rule

You can send a test email inside RedCap by navigating to Control Center > Email Users.

You can get logs from email delivery issues by opening the directory C:\home\site\repository\Files\sendmail inside the Kudu, or Advanced Tools, from your AppService page. The debug.log file should have any applicable email failures.

If emails are still not sending, check to make sure that the cron job is running with the WebJobs blade in your AppService.

Conclusion and caveats

After deployment and performing these cleanup tasks, you should have a fully working environment for a Microsoft shop: hosted in Azure, uses AzureAD for authentication, and Exchange Online for SMTP.

Since the official RedCap Azure template does not currently have support for automatic updating, you'll need to redeploy it each time. I haven't tried redeploying yet, but I'll make a new post when a major new version comes up.

Overall, this process has been difficult because the RedCap documentation is currently not updated and is often incomplete. Hopefully this guide can help someone else get the system online with modern hosting and authentication without headaches.

Footer image

Discuss...

#Powershell #Exchange

I got a request to create a Dynamic Distribution List/Group in Exchange that was automatically populated based on the users' office location.

The requestor stated that they do not want to manage any additional O365 objects. I know how to do this in Azure AD with a Dynamic Assignment, but needed to figure out how to do this in Exchange Online.

Luckily, it's pretty easy.

You'll need the Exchange Online Powershell module before running the command.

Import-Module ExchangeOnline 
Connect-ExchangeOnline
New-DynamicDistributionGroup -Name 'Raleigh Staff' -Alias 'Raleigh.Staff' -RecipientFilter "(RecipientTypeDetails -eq 'UserMailbox') -and (Office -eq 'Raleigh')"

It might take a few minutes, but after running that command, you'll see it update in the Exchange Online portal and the query will add users to the List/Group.

Discuss...

#Microsoft #Exchange

Let's say a user accidentally or external actor intentionally purged all emails from a mailbox hosted on Exchange Online. The user opens their computer and finds that they're missing all of their emails. A technician starts to troubleshoot, but finds that the user's Deleted Items folder is also emptied.

This could be a nightmare!

Luckily, Exchange Online has the ability to recover mailboxes using the Microsoft 365 Compliance center.

To do this, you'll need to use the eDiscovery tool in the Microsoft 365 Compliance center to do a few tasks:

  1. Create an eDiscovery case
  2. Specify Search criteria
  3. Export the search results
  4. Download the export
  5. Import the .pst file into the Outlook desktop app

Let's go over each of these steps.

Create an eDiscovery case

Open a browser and open the Microsoft 365 Compliance center dashboard. Login using an account with Global Admin (or equivalent) permissions. You may need to add some permissions to your account, including the eDiscovery Manager role.

On the left side of the page, expand eDiscovery and click on Core. From this page, click on the Create a case button:

Type a name for the case and a description (optional) and click the Save button:

Create Search criteria

Once you have a case created, you'll need to specify some search criteria. This means you have to specify which O365 items you want the eDiscovery to target.

Navigate back to the Core eDiscovery page and click on the name of the case to open it:

Navigate to the Searches tab. Click the “New search” button:

A new page will open with a wizard to specify search criteria. On the “Name and description” step, type in a friendly name that you'll remember and some descriptive text (optional), then click the “Next” button:

On the “Locations” step, flip the toggle for “Exchange mailboxes” and click on the “Choose users, groups, or teams” link under the “Included column”. In the pane, type the name of the user that you're wanting to restore, then click the “Done” button. Also make sure that you uncheck the box for “Add App Content for On-Premises Users”, this section is not needed. When you've selected the single mailbox, then click the “Next” button:

On the “Conditions” step, you can specify limiting factors (if needed), but leave all of the options blank to ensure you get the whole mailbox. Click the “Next” button to continue:

On the “Review your search” step, make sure the options look OK, then click the “Submit” button:

In the background, Microsoft will kick off a search with your criteria. After starting the search, go to the next step.

Export the search results

Navigate back to the Searches tab inside your case. The “Status” column will indicate when the search is complete. After the search results have been found, you'll need to export these results into a downloadable package.

Click on the name of the search to open the pane. From there, click on the “Actions” button at the bottom and select “Export results”:

The search results will begin to Export. This process can take a while, depending on the size of the mailbox.

Download the Export

Once the Export is packaged up, you'll need to download this file onto your local computer. Check the status of your eDiscovery Search Export by clicking on the Exports tab. Click on the name of your search export to open the pane.

When the export Status is complete, click on the “Download results” link:

A Windows desktop tool will download. Run the app to install the Microsoft Office 365 eDiscovery Export tool:

The application will download and install additional resources:

After the resources are downloaded, the tool will popup with some export settings. Copy and paste the Export key from the Compliance center Export page. Also, set the download location for the PST file:

The eDiscovery Export Tool will begin the process of prepping the data, downloading it, then cleaning up after it's complete:

Once it's complete, open File Manager on your computer and navigate to the Export Location you selected earlier. You'll see several files in the root directory:

The .pst file that you need will be in the Exchange folder.

Import the .pst file into the Outlook desktop app

For this next step, you'll need to use the Outlook desktop app to import the .pst file. This file has all of the users' emails and you'll be able to merge them back into the live mail profile.

Open the Outlook desktop app and navigate to the File tab in the ribbon. Navigate to Open & Export and click on the Import/Export button:

In the Import and Export Wizard popup, select “Import from another program or file” and click the Next button:

Select “Outlook Data File (.pst)” and click the Next button:

Click the Browse... button to select your downloaded .pst file and click the Next button:

Click through the last page of the wizard to begin the import. After the process completes, you can delete the downloaded .pst file.

Allow Outlook to sync the mailbox to Exchange Online. This will ensure that all email messages are synced and available at any location. This process may take a while, depending on the users' internet speed:

Discuss...

#Exchange #Powershell

I was looking for some good documentation online on how to recall emails from user inboxes.

First, import and connect to the relevant Powershell modules and environments:

Install-Module ExchangeOnlineManagement
Import-Module ExchangeOnlineManagement
Connect-IPPSSession -UserPrincipalName XXX # Change this value to your account with Global Admin or Compliance Admin permissions

Next, create a new Compliance Search by defining your scope and query. For this example, I'm going to keep it simple by targeting all Exchange content and a subject line search:

# Change the subject line to the emails' subject line in question
New-ComplianceSearch -Name "New search" -ExchangeLocation All -ContentMatchQuery '(Subject:"Spammy email subject line")' | Start-ComplianceSearch

Depending on the size of your tenant, this may take a while, maybe a few hours. You can check the status of the search by running Get-ComplianceSearch

After the search status says 'Completed', the following command to purge and delete all instances of the email from your tenant:

New-ComplianceSearchAction -SearchName "New search" -Purge -PurgeType HardDelete

This command may take a while too, depending on the size of your tenant. You can check the status of the search action with the command Get-ComplianceSearchAction

You can see the results of these actions in the Microsoft Compliance center and a full audit log of your admin actions will be available to view through the portal.

It might be a good idea to do some spot checking before you delete all of the emails. If you want to check the content of the email before you delete, you will need to add yourself to the Role “Compliance Data Administrator” in Azure AD.

After adding the Role to your account, navigate to the Purview or Compliance admin dashboard: https://compliance.microsoft.com/

Navigate to the “Content search” section and select the Compliance Search that you saved earlier. In the popup pane, click the “Review sample” button:

Screenshot of Microsoft Purview with Content search pane opened

From this view, you can click on items on the left side of the pane and view the message on the right:

Screenshot of Microsoft Purview, Content search preview samples

By taking a second look before deleting emails, this could prevent some accidental deletions and save you some headaches.

Discuss...

#powershell #Exchange

If you're using Microsoft Exchange Online, there's no way to currently see when a Mail Contact was created on the web dashboard.

I wanted to know when an address was added as a Mail Contact in one of our tenants, but I also wasn't able to get an audit trail using the Microsoft Compliance center.

As a workaround, this Powershell command will give the basic info for “WhenCreated”.

Get-Recipient -RecipientTypeDetails MailContact -ResultSize Unlimited | sort WhenCreated | select Name,Alias,WhenCreated