Monday, August 16, 2021

How to convert a mailbox to be a shared mailbox, and remove their AD (Active Directory) account

 If you want to convert a mailbox to shared to preserve it, but you want to disable or delete the AD account, do the following-


 - Go into mailboxes in Exchange Admin Center, click "Convert to Shared" on the right.

 - To to the users in Microsoft 365, remove the users license.

 - Disable or delete the AD account, wait for Azure AD to sync.

 - Under Admin Centers, click Azure Active Directory, Users, Deleted Users.  Select the users and click "Restore Users."  This will move them to a "Cloud User" which will need to be maintained to prevent the mailbox from being deleted.  This account will not be able to log into the mailbox, however, so it presents a pretty minimal risk.  You can set a complex password and enable MFA.

Tuesday, August 10, 2021

Enable Modern Authentication (ModernAuth, OAuth) in Office 365, resolve Outlook Clients not using modern auth.

 First- Ensure Office 365 is set for Modern Auth-

    - Log in to the Office 365 portal, Edge seems to work the best.
    - Admin Centers, Exchange, Classic Exchange Admin Center.   
    - Hybrid, click "Configure" under Exchange Online Powershell Module.
    - Type "
Connect-EXOPSSession -UserPrincipalName <your UPN>"
    - Get-OrganizationConfig | ft OAuth*
        - If it's set to "True", you're good to go, modern auth is enabled.
    - If it's set to false- 
Set-OrganizationConfig -OAuth2ClientProfileEnabled $True
    - Give it a couple of hours.

If a user is still getting the basic prompt in outlook-

    - Go into control panel, credential manager, delete everything related
    - In regedit, go to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Identity. 
    - Create a new DWORD named "EnableADAL" and give it a value 1

If that doesn't work-

    - Create a new DWORD named "DisableAADWAM" and give it a value 1
    - Create a new DWORD named "DisableADALatopWAMOverride" and give it a value 1