Changing Linkedin default from Connect to Follow


By default, you’ll see that most people on Linkedin have a Connect button like shown above. Now that is a great option, however unfortunately, I’m sure many people have connected with someone on Linkedin innocently and almost immediately you get spammed since they can now message you. Of course, you can remove them but there is a better way to reduce this happening.


What you do to change the default option from Connect to Follow is go into your Privacy settings, then select Blocking and hiding. At the bottom enable Make follow primary.


Now the default action will be Follow as seen above. Is Connect still there?


Yes, but you need go hunting for it, which means that most people trying to spam you probably won’t bother doing that.

Not foolproof I admit, but certainly a handy way to make it just that little bit harder to spam you!

Easily connect using the Linkedin mobile app

One of things that I’m spending a lot of time here at the MVP Summit in Seattle doing is networking with other MVPs. One of the best tools to connect is via Linkedin. Here’s a really simple way to make that happen that I learned about today (and can share) using the Linkedin mobile app.


Fire up the Linkedin App on your mobile device. Here I’ll use iOS. To the right of the search bar you’ll notice four squares arranged together as shown above. Select this.


This should take you to a screen like shown above. Across the top you now have two options, Scan and My code. Scan allows you to use the camera on your device to scan someone else’s Linkedin QR code. My Code display your QR code that you can share with others.

Once you have scanned in the QR code using this method, that person’s Linkedin details will appear on your mobile device and you can connect. Easy eh?

Need to Know podcast–Episode 203

We catch you up with everything in the Microsoft Cloud and then spend some time talking about the new certifications that have just become available from Microsoft for both Microsoft 365 and Azure. I share some of my experiences and thought around doing these exams and their value to all IT Professionals going forward. We’ll be covering more about certifications down the track but this one should get you thinking about which one you should do!

Take a listen and let us know what you think –

You can listen directly to this episode at:

Subscribe via iTunes at:

The podcast is also available on Stitcher at:

Don’t forget to give the show a rating as well as send us any feedback or suggestions you may have for the show.




Patron Community

Azure opens datacenters in Africa

Microsoft announces Azure Sentinel

Introducing Microsoft Threat Experts

Get the latest Microsoft Security Intelligence report

Teams V Slack

Connect to Office 365 PowerShell via GUI

MS-100 Certification

MS-101 Certification

Email message traces in Office 365

A very common need these days is to do an email message trace. This can be done the old way in the Exchange Online Admin center or the new way via Mail Flow in the Security and Compliance center.


You simply enter the details and then run a search.


and the output looks like the above, where you can also drill in and get more detail.


As with all things Office 365, you can achieve the exact same thing using PowerShell as I have shown above. The code to achieve this is quite straight forward but I have uploaded it to my GitHub repo to save you the trouble:

Where PowerShell comes into its own is when you need to a variety of tasks, perhaps an investigation of a breach. Using PowerShell you can easily dump all the information to CSV for further analysis rather than having to root it out in the web interface.

Reporting mailbox logins

Before much of what is covered here is possible you need to ensure you have enabled all the logging in your Office 365 tenant. I’ve covered how to do that here:

Enabling Office 365 mailbox auditing

Enable mailbox auditing in Exchange Online

Enable activity auditing in Office 365

Once you have done that you will be able to track what’s going on in your tenant much better.

In the situation of a compromised mailbox, a bad actor has control of it using legitimate credentials. This eliminates looking for failed logins, because there won’t be any. It also makes the finding the bad actor tougher because their access is most likely mixed in with the legitimate user.

The place to start is to run an audit log search as I have detailed here:

Searching the Office 365 activity log for failed logins


However, as I mentioned, we can no longer search for failed logins, we need to use a different search criteria. I would suggest that you instead run a search using the attribute “User signed in to mailbox” as shown above. That will produce something like shown for all users. Problem with this is that times and dates are in UTC not local time and it is cumbersome to manipulate in a web page. You can of course manipulate by exporting the results to a spreadsheet for more control.


Unsurprisingly, I feel PowerShell offers a much better solution to check the logs and report as you can see above. The script to do this I have made freely available at my Github repo here:

Basically, it will search the Audit log for Exchange Items that are Mailbox logins and send that output to a nice table via the Out-Grid command. As you can see, using Out-Grid you can now easily sort by time by clicking the column heading, and thanks to the script, the times are local not UTC!

By default, the script will check the last 48 hours but you can easily modify that to suit your needs by either entering the scope in hours or entering a start and end date in the variables at the top of the script.

With this output I can now look for suspect IPs that login into the mailbox and begin hunting from there. However, remember, all of this relies on you enable your auditing BEFORE you need it. So, if you haven’t enabled it, go do it now! You’ll find scripts to enable the logs also in my Office 365 repo here:

Monitor outbound spam as well


Hopefully everyone is well aware of the need to protect Office 365 email from inbound spam, however what are you doing about outbound spam?

Hopefully, no bad actor gains access to your environment BUT if they did and they started using you accounts to send spam email how would know?


For this reason, I suggest that it is a good idea to go into the Exchange Administration console, select Protection, then Outbound spam. Edit the default policy (that’s really your only option), then select outbound spam protection on the left hand side. Then I suggest you should enable the option to send an email when there is a suspicious outbound email to somewhere that is monitored.

That obviously, won’t stop outbound spam but it should at least give you a heads up that it is happening.

OneNote error code 0XE0001462 bukxq 19999

I received the not so helpful error code OXE0001462bukxq 19999 on an iOS device when trying to sync some OneNote notebooks.

This error I believed was the because I was mixing and matching identities on the device and inside OneNote. The result was that the notebooks would load into OneNote, I could see the sections but not any pages. I will also say that I was also playing with Intune app protection policies at the same time on the device, which probably really didn’t help.

To get rid of the error I figured that I needed to change the login credentials for each notebook. Problem was I couldn’t see how to do that within OneNote.


Turns out, what I needed to do was go into the iOS Settings, select OneNote and then down the bottom you’ll find an option to Reset OneNote as shown above.


Once you select that you’ll see the above screen giving you the option to Delete all notebooks or Delete Login credentials, which is what I selected.

I then restarted OneNote and re-authenticated to the notebooks and I was away. An easy fix when you know how, just wish the error message was a little bit more helpful. However, in the end, problem solved and new lesson learned.

Unable to enable Javascript on iOS device

While setting up a new iPhone that was enrolled in MDM and using Intune, I came across an issue when setting up the Qantas app on iOS.

When you attempt to login to the Qantas app to set it up for the first time you are shelled out to Safari and here it needs to use Javascript to complete its login process. Unfortunately, if you have Javascript disabled then you get a nasty error message that you need to enable it and you can go no further.


No problem, you think. I’ll just go into the device Settings, Safari then Advanced where you expect to see the above Javascript option. Only problem is, that for some reason, you can’t change this option because it is disabled for some reason.


In my case, the reason why it was disabled is because I had an Intune Device Restrictions policy in place that was blocking Javacript. You change this option by going into the iOS restriction policy, selecting Settings, Built-in Apps, Safari, Javascript as shown above. Change the setting from Block to Not configured, then Save the policy change and allow a few minutes for the policy to be applied to the device.

After that, I was able to re-run the Qantas app configuration and set up everything as expected. You could then, if course change the policy back if you wished to block Javascript going forward.

The lesson here is, that if something is blocked on your device that is managed by Intune, then most likely that setting is being controlled by an Intune policy and you’ll need to make the change there.