How to migrate Teams Sites from Office365 tenant to another Office365 Tenant using Migration Wiz

This image has an empty alt attribute; its file name is image.png

I have been working very closely with BitTitan for a number of years and BitTitan have been working very closely with Microsoft with the development of their Teams migration service.

The service was updated towards the end of August and this update brought a large number of enhancements which can be reviewed HERE

For years I have been migrating Office365 Tenants to other Office365 tenants and the problem still remains whereby a custom domain like contoso.com cannot exist in two Office365 tenants at once. So during acquisition or merger migration projects at what point do you migrate the Microsoft Teams sites. My recommendation is to take care of the following data sources first with the Migration Wiz user migration bundle.

Primary Mailbox
Archive Mailbox
OneDrive for Business
Outlook switch over via deployment pro.

Once the data sources above have been migrated , I would recommend that Outlook Web App access to the legacy source tenant mailboxes is blocked via running the following command

Get-Mailbox -resultsize unlimited | Set-CASMailbox -OWAEnabled $false
Get-Mailbox -resultsize unlimited | Set-CasMailbox -ActiveSyncEnabled $False

The official MigrationWiz migration guide is available HERE
Also follow this ARTICLE and setup the  Teams-FullControlApp in each source tenant.
I recommend that you use the autodiscover method to populate the project as this will also identify any incompatible items in Teams sites or channels

First step is to create the teams site in the target tenant , and do this 24 hours in advance

What_will_be_migrated_Teams.png

Next Step is to do the data migration

Validate the data and then remove the Teams licenses from the users in the source tenants with the following powershell commands. Create a new variable for each Offfice365 licensing sku that contains Teams.

Get-MsolAccountSku

$acctSKU=”contoso:O365_BUSINESS_PREMIUM”
$x = New-MsolLicenseOptions -AccountSkuId $acctSKU -DisabledPlans “TEAMS1”

$acctSKU2=”contoso:TEAMS_EXPLORATORY”
$x = New-MsolLicenseOptions -AccountSkuId $acctSKU -DisabledPlans “TEAMS1”

$acctSKU3=”contoso:O365_BUSINESS_ESSETIALS”
$x = New-MsolLicenseOptions -AccountSkuId $acctSKU -DisabledPlans “TEAMS1”

$acctSKU4=”contoso:O365_BUSINESS_ESSENTIALS”
$x = New-MsolLicenseOptions -AccountSkuId $acctSKU -DisabledPlans “TEAMS1”

Get-MsolUser | Where-Object {$_.licenses[0].AccountSku.SkuPartNumber -eq ($acctSKU).Substring($acctSKU.IndexOf(“:”)+1, $acctSKU.Length-$acctSKU.IndexOf(“:”)-1) -and $_.IsLicensed -eq $True} | Set-MsolUserLicense -LicenseOptions $x

And now all the Teams sites have been migrated and there is no chance of split brain because the Teams license has been removed from the source tenanat.

One really important point to note: MigrationWiz match users from the source to the destination based on the user prefix which is so useful when you are moving one domain from an Office365 tenant to another for example in a merger or aquistion.


How to delete Teams Chats and Meeting Chat Moderation Settings

A customer recently asked me how can we delete chat history in Microsoft Teams and the answer was really simple. Provided the tenant has the correct Office365 licensing. The solution was to create a retention policy and delete all chat history older than 1 day.

How to delete Teams Chats and Meeting Chat Moderation Settings

https://www.microsoft.com/en-us/microsoft-365/roadmap?filters=&searchterms=67175

Exchange Online to Exchange On-Prem Free \ Busy Not Working

Free busy not working in an Exchange 2016 CU17 Hybrid environment.

When a customer forgets to tell you that they previously configured Exchange Hybrid using the Modern hybrid agent, The modern hybrid agent leaves behind some configuration settings that prevent free-busy working from EOL to EOP.

I always use the classic hybrid wizard for organisations that require long term rich co-existence.

The frustrating this with this issue is that the Exchange Remote Connectivity analyzer tests WORK, which would lead you to believe everything is ok and configured correctly. But when you attempt to query availability requests for a user or resource from OWA or Outlook , the look up fails.

What does the Hybrid Agent leave behind in Exchange Online?

Two values are populated that will prevent free \ busy from EOL to EOP working.

  • OrganizationRelationship -targetsharingepr
  • Intraorgconnector -targetsharingepr

When you query these values , You may see a value like   https://a75aa21a-2f8d-4b2e-85fe-1234.resource.mailboxmigration.his.msappproxy.net/EWS/E
xchange.asmx

To resolve the issue run the following commands

  1. set-intraorgconnector -TargetSharingEpr $null
  2. set-OrganizationRelationship “Name of Org Relationship” -TargetSharingEpr $null

Teams Calendar Integration with on-premise Exchange calendars

One of the pre-requisites for Teams (online) integration with Exchange on-premise calendars is oauth authentication.

Sometimes solution providers just install a single or multiple Exchange 2016 servers to ensure the oauth pre-requisite is delivered. However if the project scenario requires Exchange on-premise mailboxes to be migrated as quickly as possible to  Exchange Online then it may seem overkill to implement Exchange 2016 servers during this transition period.

Exchange 2013 CU24 and above does not complete the oauth authentication part of the Hybrid wizard, however Microsoft do have an article on how to configure OAUTH for Exchange 2013.

Configure OAUTH for Exchange 2013 :
https://docs.microsoft.com/en-us/exchange/configure-oauth-authentication-between-exchange-and-exchange-online-organizations-exchange-2013-help

This solution works perfectly and allows an organization to transition from Exchange 2013 to Exchange Online without the requirement for Exchange 2016 servers and enables Teams to interact with Exchange 2013 on-premise calendars.

Azure AD Conditional Access Policies Best Practices

Every organisation is different and has different requirements. I have been working with conditional access for quite some time and have settled on the following policies for every organisation.

Create a security group that contains users that are permitted to access the organisations cloud services when outside of trusted locations.

Blocked Countries Conditional Access Policy

  • All Users
  • Exclude Break Glass Admin account
  • All Cloud Apps
  • Location : Blocked Countries that have been setup in the named locations section of Azure Conditional Access.
  • Access Control : Block Access

Blocked External Access

  • All users , except Break Glass Admin account and security group that contains users that are permitted access.
  • All Cloud Apps
  • Locations : Any location except trusted locations
  • Access Control : Block Access

Permit External Access 

  • Users : security group that contains users that are permitted access.
  • All Cloud Apps
  • Locations : Any location except trusted locations
  • Client Apps
    Browser
    Mobile apps and desktop clients
    Modern authentication clients
  • Grant Access : Require all of these controls
    Require Multi factor Authentication
    Require Hybrid Azure AD joined device
    Require approved client app
    Terms of Use

Mobile Device Access

  • Users : security group that contains users that are permitted access.
  • Exchange Online
  • Locations : Any location except trusted locations
  • Device Platforms : Android & IOS
  • Client Apps
    Browser
    Mobile apps and desktop clients
    Modern authentication clients
  • Grant Access : Require all of these controls
    Require Multi factor Authentication
    Require device to be marked as compliant (Enrolled in Intune)
    Require approved client app

Why still enable MFA for the mobile device access policy. When the Microsoft Authenticator application is installed on an Android or IOS device. It acts like an SSO broker and can communicate with the modern authentication Microsoft Outlook client.

Block Legacy Protocols

Simply replicate the legacy : Baseline policy: Block legacy authentication (Preview)