One thing that many may not realise with Office 365 is that you can enable users to reset their own passwords.

There are some conditions here when enabling this. If your environment does not have Azure AD Connect synchronizing users from on-premises to the cloud (i.e. what is known as ‘cloud only’ users) then you need no additions. If however, you do have a synchronized environment you will need to purchase Azure AD Premium, configure password write back and assign licenses to each user you wish to have self service password resets enabled for. This is because with an synchronized environment, the on premises domain controller is the source of all user details and from here it is hashed, encrypted and sync’ed to Office 365. Thus, if a user does change their password, using this cloud process, in a matter of moments that change is overwritten with what is on premises thanks to the synchronization configuration. However, Azure AD Premium provides two way password sync (on-prem to cloud and cloud to on prem). Thus, with Azure AD Premium in place, when a user resets their password in the cloud it gets sync’ed back to on premises. Without Azure AD Premium it doesn’t.

To enable self service password resets navigate to the Azure portal for that tenant using an Office 365 global administrator account.

You navigate there from the Office 365 Admin center by selecting Azure AD under the Admin centers option as shown above.

Locate the option Azure Active Directory from the list of options in the Azure portal on the left and select that.

From the blade that appears select Password Reset as shown above.

The Properties option allows you to enable password resets for selected or all users. Don’t forget to  press the Save button at the top when you have made your selection.

The Authentication methods allows you to determine how users will verify their identity when requesting their password to be reset.

They can be required for one or two forms of identity and there are four methods available – email, mobile phone, office phone and security questions.

In the case of security questions, you can select from 3 – 5 to be part of the registration process and 3 – 5 as being required to verify identity.

When you go to select security questions you are able to select a number of pre-defined or custom questions as well as mix of both as shown above.

Again, make sure that you Save your selections before continuing.

The Registration option allows you to force users to have to register their recovery options at next login or complete them manually.

The Notifications option allows you to set whether users are notified via email when their password is reset and whether all administrators are notified when any administrator resets their password.

The Customization option allow you to set a custom link users can refer to if they need further assistance with this process.

With all these options in place, and with users being forced to set their recovery options, the next time they login successfully they will see the above message prompting them to commence the recovery process.

Users should select Next to continue.

Users will now see the list of verification options that you set for them to complete. They need to work through all of these individually.

For example, with the mobile phone option, they enter their number and receive a code to verify.

With an email address verification they will receive a code that they need to verify.

Once the user has completed all the verification methods they will proceed to their Office 365 portal as normal.

When a user needs to reset their password they can select the link Can’t access your account? at the bottom of the login area.

They then be prompted to select a personal or work account. Normally, they will then select a work account to proceed.

To verify that the process requesting the password reset is not an automated bot, the user will need to complete a captcha as shown above.

They will then be taken to a screen where they can select from the methods available to verify their identity. These were set up previously by each individual user and should be unique for that user.

Once the user successfully completes the verification process they will be request to reset their password,

which when complete, will allow them to access their Office 365 account again.

The main benefit of enabling user self service password resets in Office 365 is that it allows users to manage their own passwords immediately and without having to contact an administrator to complete the reset. It is important that you ensure that you have enough verification methods for your environment and all users complete the registration process.

Again remember, that out of the box, Office 365 self service password resets work with cloud only identities. If you are using synchronized identities you will need to purchase Azure AD Premium and configure password write back to your on premises environment.

One of the really great things about Office 365 is it’s compliance features. Here’s one you may not know about.

Navigate to the Security and Compliance center after logging into your tenant as an administrator with appropriate rights. From the menu on the left select Data Governance.

Then from the menu that appear select Supervision.

You’ll need to create a new policy which you’ll start by giving a Name and a Description.

Next, select which users in your tenant you want to supervise. That is, which users communications do you wish to monitor.

Next, select the monitoring direction, here I selected Inbound and Outbound. I also elected to Add a condition but you’ll also see there are lot of monitoring choices here form the pull down menu.

I decided that I want to monitor my users for the use of the word ‘bananna’ because I really want to know what the monkey’s are doing with my banannas. Yes, I spelt it in a special ‘unique’ way so I can trigger this condition deliberately for demos.

Next, I decided what level of communications I want to review. The default here is 10% and you’ll need to be careful about overloading yourself with too much to monitor. I set this to 100% in this case so I will always get a result (again for demo reasons).

Next, I enter the users who will review the material. Basically, these people will get access to the material to review which I’ll come to soon.

You review your settings and Finish to save and enforce the policy.

What Office 365 now does is effectively create a private shared mailbox that the reviewers can attach to and into which the material to review will be sent. They simply attach to this mailbox as they would any other shared mailbox. The details of this mailbox will be provided once the policy has been enabled.

As you can see, my reviewer can now attach to the supervisory shared mailbox and view any contents there. As you can see there is already a need to review an email that mentions the search term ‘bananna’. Those damm monkeys!

As I mentioned, Office 365 really has some great tool to monitor communication in your business. Take a look inside the Security and Compliance center to see options are available to you.