Using Azure AD B2B Sharing with SharePoint Online

A common problem that many businesses have is securely sharing their Office 365 resources, like a SharePoint Team site, with users outside their organisation quickly and easily.

Microsoft have added a great new feature called Azure AD B2B sharing that greatly simplifies making Office 365 resources like a SharePoint Online Team Site available to users who are not part of the same Office 365 tenant.

There will be typically two types of external users who reside outside an Office 365 tenant:

1. Those with an existing Azure AD account thanks to being an user of a Microsoft commercial product such as Office 365

or

2. Those without an existing Azure AD account

Here is the typical process for sharing an Office 365 Team Site with both an external Office 365 user (i.e. already has Azure AD) and an external user who just has an email address (i.e. doesn’t have Azure AD).

image

In this case I want to share the above Test site (https://tenantname.sharepoint.com/sites/test) with two external users. The Office 365 user will be admin@ciaops365.com and the standard user will be aston.martin@supercarhelp.com.

The Azure AD B2B process does not allow you to use consumer domains like @hotmail.com, @outlook.com, @gmail.com, etc. Youcan only use custom domains.

The first thing I need to do is ensure that the Team Site I want to share has been enabled for external sharing.

You do this by navigating to the SharePoint admin center after logging into the Office 365 portal as an administrator.

image

You select the site collection in question (here https://tenantname.sharepoint.com/sites/test/) and then select the Sharing button on the Ribbon Menu.

image

This will reveal a dialog box like that is shown above. Ensure either Allow external users who accept sharing invitations and sign in as authenticated users or Allow both external users who accept sharing invitations and anonymous guest links is selected an save any changes made.

image

You should then return to the Office 365 admin center and create a new security group for these external users to reside in. You do this via the Groups option on the left hand side of the Office admin center.

image

When you create a new Office 365 security group using the portal you must add at least one member to that group. In this case the group was created with a single member and then immediately afterwards the group was edited and that initial user was removed. The end result here is a new Office 365 security group called Externals that contains no members.

image

You now need to return to the SharePoint Online Team Site and assign the appropriate permissions to this new security group. In this case the whole Team Site will be shared with any member of the security group Externals and they will be permitted Edit rights as shown above (i.e. they will basically have ‘Member’ rights on that site).

image

You’ll then need to run PowerShell and connect to the Office 365 tenant you wish to share. I have detailed how to do that previously here:

Configuring PowerShell Access in Office 365

I also have an online course available that covers the material in more depth:

PowerShell for Office 365

Once you have connected to the tenant you’ll need to the command:

get-msolgroup | fl displayname, objectid

This will return a list of Office 365 security groups as shown above. You then need to record the ObjectId for the security group you just created that will contain the external users (here Externals).

You will then need to visit:

https://azure.microsoft.com/en-us/documentation/articles/active-directory-b2b-collaboration-overview/#csv-file-format

and obtain the format for the CSV import file that is required.

image

Into the CSV file you enter the following information into the columns:

Email = users email address
Display Name = Firstname Lastname
InviteReplyURL = SharePoint Team Site being shared (here https://tenantname.sharepoint.com/sites/test/)
InviteAppresources = leave blank
InvitegroupResources = ObjectID obtained from PowerShell step
InviteContactUsURL = A contact URL. Here just my normal web site.

Once each user you desire to have access to the SharePoint site has been entered in its own row, save the CSV file.

You’ll then need to access the Azure AD for the tenant. If you haven’t yet enabled this see my blog post:

Enabling your Office 365 Azure AD

or my online course:

Integrating Azure Active Directory Features with Office 365

image

You’ll then need to navigate to the users area of you Office 365 Azure AD as shown above.

image

image

You’ll then need to select the Add User button at the bottom of the page.

image

In the dialog window that appears you’ll need to select the Users in partner companies option in the Type of User field. You’ll also need to specify the location of the CSV file to upload with the users to be provisioned that you just created.

When this is complete, select the check mark button in the lower right.

image

The import process will now run. When complete you will receive a status message at the bottom of the Azure management console as shown above. You can select the option to view the report to verify there are no errors.

image

If you do view the report and everything has worked as expected the status should say Email generation started as shown above for the external user and

image

and Directory invite operation finished for the Office 365 user.

image

Each user should then receive an email like the one above with a link to access the shared application at anytime.

image

The first time that the non-Office 365 user clicks on the link they will be taken to an Application Invite page as shown above.

(Side note – if you are wondering how the image on the left of the Application Invite page has been customised, see my my online course:

Integrating Azure Active Directory Features with Office 365

)

image

You should see that the email address has already been entered. All the user needs to do is select the Accept button.

image

Since this user doesn’t have an existing Azure AD account they need to create a new one. They will therefore be prompted to complete a password as well as confirm their name and country.

When this is complete select the Sign up button to continue.

image

It will take a few moments for the new Azure AD account to be created

image

The user will then need to login with their email address and the password just entered.

image

Then they will have access to the shared SharePoint site as shown above.

If they select the link in the email again, they will taken to a standard Office 365 login page where they need to again use their email address and password to access the site.

image

Now if the Office 365 external user clicks on their received email link they will be taken to a similar Application Invite page as shown before. Simply select the Accept button to proceed.

image

Because the Office 365 external user already has an Azure AD account they do not need to establish a password, they are instead taken to their own tenant login page as shown above.

image

But once they login they are automatically taken to the destination shared SharePoint Team Site just like the previous user.

image

If you return and view the securities of the SharePoint Team Site as an administrator you should see the Office 365 security group created previously as shown above.

image

If you then view the Office 365 security group from the Office 365 admin center you should see the two users as shown above.

So now both users can simply select the link in their email to return to the shared Team Site at any point in the future.

image

If the non-Office 365 user attempts to access Office 365 via the standard URL (i.e. https://login.microsoftonline.com) they can login and when they do they see the above screen.

image

If they select the App Launcher in the top left they see the above tiles.

image

If they then select the Admin tile they are basically stepped through the process of verifying their own domain and creating a full office 365 account. Some guerilla marketing there maybe?

What I have shown here is only what is possible with SharePoint but as the recent video from Microsoft Mechanics highlights you can use a similar process to share apps from the Windows Azure Single Sign On Apps portal that is also part of Office 365.

If you want to know more about setting up the includes office 365 Azure AD portal then

see my my online course:

Integrating Azure Active Directory Features with Office 365

What’s coming soon will be the ability to use social media accounts like Twitter, Facebook and Google Plus to login to externally shared Office 365 resources. That is going to really make external sharing of Office 365 information easy. I can’t want for when that is available and I’ll make sure I write an article on it.

In summary, using the built in B2B collaboration that comes with Office 365 you can now more easily share information with external parties that have their own domain.

What this stuff should also illustrate is how important Azure AD is to Office 365 and how you really need to enable it to get access to the additional options that are available with Office 365. In short, if you are not using Azure AD with Office 365 then you are driving around everywhere in first gear!

Also, please don’t forget to take a look at all my online courses at:

http://www.ciaopsacademy.com

You may even find a lesson about this very topic in there shortly.

Change SharePoint Online Team site logo

One of the challenges with SharePoint Online is around user engagement. A step towards solving this can be the branding of Teams Sites from the default. There are number of simple branding elements that can be configured via a browser, this first of these is to change the site logo.

image

The site logo is located in the top left of a Team Site, just below the Browse link as shown above. To change the site logo you’ll need to have appropriate permissions.

image

The first step in the process is to select the Cog icon in the top right of the page. From the menu that appears select Site Settings.

image

image

On the Site Settings page, in the top right, under the Look and Feel heading, select Title, description and logo.

image

On the Title, Description, and Logo page scroll down to the bottom to locate the Logo and Description section.

image

Here you can see that you can add a logo from either your computer or SharePoint. Select the From Computer link to upload a new image from your desktop.

image

You can now select the Choose file button and navigate to the location of the file you wish to use as the new logo.

By default, uploaded logo images will be saved into a hidden Document Library on the the Team Site called Site Assests. If you select the Choose Folder button you can alter this location.

image

Selecting the Choose Folder button will open a new windows allowing you to navigate the folder structure of the Site Assets Document Library. You will note that you can only navigate the Site Assets folder and below, you can’t navigate to anywhere else in the SharePoint Online Team Site.

In most cases the default location of the root of the Site Assets Document Library is suitable as a location for uploaded logos, so accept this and complete the process by selecting the OK button.

image

You should now see you logo displayed as shown above, you will also see the path in SharePoint Online where this file will be saved.

You can also enter a description of the logo. This description is visible when you mouse over the logo or when the images doesn’t display. It is always best practice to ensure that you enter some text here.

When you have finished making any changes, scroll to the bottom of the page and select the OK button to apply these changes to your Team Site.

image

If you return to the home page of your Team Site you should now see the new logo displayed as shown above.

image

If instead of uploading the image from yoru desktop you wish to select an image already saved in SharePoint Online you select the From Sharepoint link from the change logo region detailed above. When you do so, you’ll see a dialog appear like that shown above.

Depending on the permissions you have with the SharePoint Site Collection (i.e. all the Teams Sites under this URL), you can navigate to and select an image from anywhere in that Site Collection.

For example, you may have created a sub-site in which you want to change the logo. However, you may wish to store all the images in the parent location. All you need to do to use this parent location is navigate to it using the dialog shown above.

It is generally best practice to have the copy of the logo you wish to use in the same Team Site as it will appear. If you wish to use a logo from other locations in the Site Collection you’ll need to ensure that users have at least read rights to that location so they can view the logo when the site renders. If they haven’t got rights, then the logo will not display.

You typically use the From SharePoint option for the logo when the logo already exists in SharePoint Online. This ensure that there is only a single point of truth for that image, which is handy if it ever needs to be changed or updated.

SharePoint Online Email Alerts

image

Email alerts allow users to receive a notification in their inbox when something changes in SharePoint. Alerts are available on most SharePoint apps such as calendars, contacts, lists and so on. In this case we’ll look at configuring an email alert on a SharePoint Document Library.

The first step is to navigate to the location within SharePoint where you wish to configure the alert.

image

If you then select the Library tab in the top left of the page this should reveal the Ribbon Menu as shown above.

image

You need to locate and select the Alert Me button in the middle of the ribbon in the Share & Track section.

image

This will reveal a drop down menu as shown above. Select the Set alert on this library option to continue.

image

This will open a new dialog like that shown above.

image

You can now customise what the name of this alert will be called using the Alert Title box at the top of the page. Best practice is always to make it as meaningful as possible.

image

The Send Alerts To box should already be populated with the name of the current user. You can add additional names here if you have the appropriate security settings, however it is generally best practices for users to individually configure their own alert settings.

image

If the option is available it may be possible to configure the alert to be sent via SMS, in which case you would need to enter the mobile phone number. However, in most cases you will select the E-Mail option.

The email address to the right will automatically be taken from the Office 365 profile of the current user.

image

Depending on the frequency of change that occurs in this location you may wish to not receive alerts for every change that occurs. You can use the Change Type selection to determine what you wil be alerted to. Remember that the default All changes option means you will receive an email alert when anything changes in that location, that is when new items are created and when items are changed and when they are deleted.

Best practice is to use SharePoint email alerts only to inform you of the important changes that take place in that SharePoint location. Having the frequency of alerts set too high can result in a significant volume of emails. Best practice is therefore to start with the most infrequent option and increase the frequency as required.

You can of course edit and adjust any of these alert settings at any point in the future.

image

The Send Alerts of These Changes option allows you to further customise the frequency of receiving alerts from this area. Again, best practice is always to set the least frequent alert option and adjust if required.

image

The final option allows you to determine when an email will be sent informing you of the changes you selected previously. Electing to be alerted immediately can be very distracting when set on an area in SharePoint that is changing regularly. In most cases best practice is to set the option for a daily summary.

When you select either a daily or weekly summary you will be prompted to enter a time when the alert will be delivered. The suggested times for a daly summary are either first thing in the morning or last thing in the evening.

Once you have made all the desired configuration changes, scroll down to the bottom of the page and select the OK button to save you changes.

image

You should immediately receive an email notifcation confirming the settings that you have just configured. If you did not receive an email firstly check you junk e-mail folder and then verify the configuration settings via the process above.

This email is your confirmation that your alert settings for the area in SharePoint have been set. The email should provide a link to the area in SharePoint that you configure the alert on (here Demo) and a link to where you can change all the alerts you have configured for the SharePoint site.

image

Now when an appropriate change is made to this area you will receive an email advising you of the change as shown above. These notification emails are not sent instantaneously, they are sent by a regular job that runs on the SharePoint server every few minutes so they may take a few moments to appear in your inbox.

image

As noted previous, it is generally best practice to avoid using many emails alerts with SharePoint as the volume of notifications can become overwhelming. You can return to the Alert Me button at any location and select the Manage My Alerts option.

image

You will then see all the alerts you have configured across yoru SharePoint site. You can select and delete any you wish easily or by simply clicking on the name of the alert you can modify its configuration.

image

Not only can you create an alert on an app inside a SharePoint Team site but you can also create an alert on an single item, in this case a file in a Document Library.

In this case you select the individual file in the Document Library and then File tab in the top left of the window to reveal the Ribbon Menu as shown above.

image

In the middle of the ribbon you will again find an Alert Me button you can select. Once selected you will follow through the same process as outlined previously about setting an alert, only in this case the alert will be on a single item in SharePoint.This single item could be an appointment in a calendar, a single line in a list etc..

In summary, alerts are set on a per user basis and provide a way to let you know, typically via email, when information in a SharePoint location has changed. You can customise these alerts to provide information about varying levels of change, for example, all changes versus just deletions. You can also customise how often these email alerts are sent, immediately versus a daily summary. The notification you receive in you inbox will provide you information about what has changes as well as links to the locations in SharePoint.

Best practice is always to minimise the amount of alerts utilised on a site and their frequency to avoid being overwhelmed with emails. They however, provide an excellent method of being notified when specific SharePoint information changes.

Using Office 365 Rights Management with SharePoint Online

You can protect the documents you save into SharePoint Online so that they can’t be opened by people without the appropriate security. This prevents situations where a confidential file is downloaded from SharePoint Online and then forwarded to someone that it should be for example.

This document control is managed by Azure Rights Management which you can easily enable in your Office 365 tenant for both Exchange Online and SharePoint Online. I have detailed how to enable office 365 Rights Management and use it with Office 365 message encryption previously at:

Office 365 message encryption

So check out that post to find out how to enable right management in Office 365 and then return here to find out how to use it with SharePoint Online.

After rights management has been enable in Office 365 you’ll need to enable it also in SharePoint Online.

image

Go to the SharePoint admin center and select Settings from the menu on the left.

image

Scroll down the options on the right until you locate Information Rights Management (IRM). Select Use the IRM service specified in your configuration.

Scroll to the bottom of the page and select OK to save your configuration.

image

Navigate to the item you wish to protect in SharePoint Online, here a Document Library.

image

Select the Library tab at the top left of the page to reveal the Ribbon Menu as shown above.

image

On the very right of the Ribbon select the Library Settings icon.

image

From the column in the middle of the page with the heading Permissions and Management select the Information Rights Management option.

image

Ensure the Restrict permissions on this library on download is checked. Also give he policy a title and description.

image

If you select the Show Options link below these description fields you’ll see a number of different options you can use to customise how the rights will be applied to the documents.

When complete, select the OK button at the bottom of the page to save your configuration.

 image

Basically now when a document is downloaded from that library and opened by someone without appropriate permissions they will see the above message preventing them from accessing the document.

There is whole lot more you can do with rights management in Office 365 but hopefully this post has given you enough to get started on the journey of securing your documents better.

If you found value from this post I’d recommend you take a look at my online training courses at:

http://www.ciaopsacademy.com

where you’ll find lots and lots of courses on Office 365, SharePoint, Azure and more. These courses help support the information I provide here for free and on my YouTube channel, podcast, etc. I appreciate everyone who has already signed up to one of my courses and keep your eyes peeled for more coming soon.

Integrating Azure AD Features with Office 365 online course

azure-logo

Just uploaded another online course to my training academy. This one is:

Integrating Azure Active Directory features with Office 365

It will show you how to enable you Azure AD inside Office 365 and then use it to brand your tenant, create a web based single sign on apps portal as well as password reset portal. It also covers how to enable rights management in Office 365.

Each lesson in the course includes a training video, download notes and quiz style questions to test your knowledge.

I have also added this course in as a module to my larger

Getting Started with Office 365 Administration

course which now has 10 sections with over 50 video lessons, downloadable course notes and more!

If you don’t follow my social media feeds then you have probably missed that for November 2015 I’m offering the first 15 people who sign up to the Office 365 admin course a 25% discount. That is over $85 off the normal price but only for the first 15 and only for November, whichever comes first. Sign up today to take advantage of the discount before its gone.

Keep you eyes peeled for more courses and discount from the CIAOPS Online Academy.

Microsoft Advanced Threat Analytics

If you are wondering what Microsoft Advanced Threat Analytics is then take a look at these two videos.

and

To learn about how the product works then have a look at:

Microsoft Advanced Threat Analytics coming next month

and

Microsoft Advanced Threat Analytics public preview now available

If you are looking to purchase the product today have a look at:

Microsoft Advanced Threat Analytics Pricing

For most most smaller customers the best way to get the product today is via the:

Enterprise Mobility Suite

However, it is also expected to be part of the new E5 Office 365 license that will be available shortly.

— Update —

image

I found today that if you go to the Add-ons for your Office 365 subscription you can purchase Exchange Online Threat Protection as a stand alone extra to your existing Exchange Online mailboxes. That make it easy to quickly and easily increase the security of your email protection with Office 365.

For more details see:

Exchange Online Advanced Threat Protection

OneDrive consumer space gets scaled back

In a world where we are use to seeing more it is surprising to discover that Microsoft is limiting the amount of space available in OneDrive consumer. That is until you read this blog post they recently posted:

https://blog.onedrive.com/onedrive_changes/

In essence what it says is that a small number of people have been ‘exploiting’ the amount of storage available in OneDrive consumer to use it for things that it wasn’t really designed for such as storing images of hard disks, entire movie collections and so on.

To prevent this and ensure OneDrive is used as a collaboration tool rather than just a free dumping ground for data Microsoft will start to limit the amount of space available to users of the service. If you want to know how that may affect you I suggest you read the above blog post from Microsoft.

The following quote from the blog post sums it up well and reinforces what I say about all versions of OneDrive:

“OneDrive has always been designed to be more than basic file storage and backup. These changes are needed to ensure that we can continue to deliver a collaborative, connected, and intelligent service. They will allow us to continue to innovate and make OneDrive the best option for people who want to be productive and do more.”

I see so many people trying to shoehorn their whole one premises file server into OneDrive for Business. It is not designed for that and you should not be merely copying all your data to a location that was designed for individuals not teams. You should also not be dumping all your data (much of it unused generally) into a single document library. SharePoint Online (which includes OneDrive for Business) is designed primarily for collaboration. If all you want is web storage then SharePoint Online is probably not the best solution.

I wrote the following article a while back to highlight the appropriate way to consider migrations to SharePoint Online:

The Classic SharePoint Online Migration Mistake

The important thing to remember here is that this recent control of the space available to OneDrive refers to the consumer version NOT OneDrive for Business (for now). However importantly, the takeaway for Office 365 users here is that OneDrive for Business is designed for individual users and is not designed as a general data dumping ground for data.

Go forth and collaborate.

CIAOPS Configuring Office 365 Federated Identity online course

fed-id

I’ve just made available my next online course – Configuring Office 365 Identity which you can view here:

http://ciaops-academy.teachable.com/courses/configuring-office-365-federated-identity

It is aimed at teaching you the basics of configuring ADFS and Single Sign On with Office 365.

The course contains 6 lessons:

  1. Understanding Office 365 Federated Identity
  2. Preparing the environment for Office 365 Federated Identity
  3. Setting up the Federated ADFS Server
  4. Converting to an Office 365 Federated Domain
  5. Setting up a Federated ADFS Proxy Server
  6. Troubleshooting Office 365 Federation Configurations

with each lesson containing a video, downloadable lesson notes and some external resources.

You can sign up for this or any of the other courses I have published via the new URL:

www.ciaopsacademy.com

This course has also been included in the Getting Started with Office 365 Administration course that now covers 9 areas and aims to provide a comprehensive introduction to managing all aspects of Office 365.

I appreciate those who have supported me by already signing up for my online courses. The more support I get, the more courses I can develop.

if you have any suggestions or ideas for online courses that you’d like to see me do please contact me, I’d love to hear from you.