Chapter 3: Administering Office 365 with PowerShell

PowerShell can be used to perform administrative tasks not available through admin centers and the graphical user interface (GUI). Even for tasks that are available through the GUI, PowerShell can often perform tasks more quickly in fewer clicks and can be scheduled to perform routine tasks (such as updating exported reports regularly). In this chapter, we look at a few specific PowerShell recipes to enhance Office 365 admins' abilities and efficiency.

We'll cover the following recipes in this chapter:

• Getting a list of all available commands
• Creating a user
• Disabling a user
• Changing user settings or profile information
• Getting a list of all users with user properties
• Changing a user password
• Connecting via PowerShell to SharePoint Online
• Creating a SharePoint site collection
• Adding a new site collection admin to all SharePoint Online sites
• Restoring a deleted OneDrive site...

Technical requirements

To start, an admin must have PowerShell installed, either the command line, black screen version or an Integrated Scripting Environment (ISE). The user must have valid credentials and have an appropriate admin role (such as Global Admin). 

As PowerShell for Office 365 has advanced, additional tools are available to minimize the past troubles of making a connection to your tenant. For this, you must download the Microsoft Online Services Sign-In Assistant (https://www.microsoft.com/en-us/Download/details.aspx). Download the files and install it on your PC.  

The first time you connect to your Office 365 tenant, you'll want to set the ExecutionPolicy to RemoteSigned. This is done by opening a PowerShell window with elevated rights (Run as administrator) and executing the following code: 

Set-ExecutionPolicy RemoteSigned 

Once prompted, press Y and hit Enter.  

Additionally...

Getting a list of all available commands

PowerShell is a growing library of tools that admins and developers can use to directly interact with the "backend" of an Office 365 tenant. Knowing which options are available is critical to using the most up-to-date and capable function to accomplish your task. In this recipe, we'll request a list of all available commands by PowerShell.

Getting ready

Using the skills learned in the Setting up the PowerShell environment recipe from Chapter 1, Office 365 Setup and Basic Administration, connect to your Office 365 tenant via PowerShell.

The module name in the command string can be replaced by the name of the PowerShell module you'd like to query (for example, MsOnline for basic commands; AzureAD for Azure AD-specific commands). The example that follows shows MsOnline, which provides many basic commands. However, advanced users will need to install and run more advanced modules, including Azure AD, Teams, SharePoint...

Creating a user

Most tenant admins and other IT professionals prefer to automate the creation of new users in a tenant. This requires passing certain values between whatever Human Resources or onboarding system is being used to PowerShell. However, even if you are not looking to automate this process and are tired of clicking through a ton of screens to enter information, this recipe provides admins an easy method of getting a user provisioned.

Getting ready

Using the skills learned in the Setting up the PowerShell environment recipe from Chapter 1, Office 365 Setup and Basic Administration, connect to your Office 365 tenant via PowerShell.

How to do it…

1. Enter the following command into your PowerShell or ISE window, replacing the details of UserPrincipalName, DisplayName, FirstName, and LastName as appropriate:

   New-MsolUser -UserPrincipalName [e-mail] -DisplayName "Test Account" -FirstName "Test" -LastName ...

Disabling a user

When a user's access needs to be temporarily disabled so that the user cannot access Office 365 with those credentials but the data and user setup are not lost, an admin does not need to completely remove or unlicense a user. Instead, simply blocking the user's credentials will suffice. Let's disable a user in this recipe.

Getting ready

Using the skills learned in the Setting up the PowerShell environment recipe from Chapter 1, Office 365 Setup and Basic Administration, connect to your Office 365 tenant via PowerShell.

How to do it…

Update the UserPrincipalName parameter to the appropriate user, and then run the following code snippet:

Set-MsolUser -UserPrincipalName [e-mail] -BlockCredential $true

How it works…

You've just disabled a user in a single step. The BlockCredential property on a user's profile will stop a user from being able to gain access with the blocked credentials...

Changing user settings or profile information

Name changes, office moves, password reset requests, and other updates are frequent requests from users. An admin must be able to make these updates quickly and easily within a system. While it is possible to accomplish these tasks within the tenant user interface, having the ability to script these changes (or even automate them) is the dream of any admin. This recipe covers several possibilities for making updates to a user's settings or profile information via PowerShell.

Getting ready

Using the skills learned in the Setting up the PowerShell environment recipe from Chapter 1, Office 365 Setup and Basic Administration, connect to your Office 365 tenant via PowerShell.

The UserPrincipalName parameter is a required parameter to identify which user should be impacted by the change you are making.

How to do it…

The following two examples are PowerShell snippets that show how to make user updates.

Use this...

Getting a list of all users with user properties

The Get-MsolUser cmdlet in the MsOnline PowerShell module is a very flexible and useful tool for any admin's toolkit. The cmdlet gives an admin instant access to all user properties within a tenant, but can also be restricted to specific users or even users of a certain type.

Generating reports of users and groups of users is a common task for any tenant admin. This recipe focuses on how to pull that data with only a few lines of code.

Let's practice generating a list of all users with properties.

Getting ready

Using the skills learned in the Setting up the PowerShell environment recipe from Chapter 1, Office 365 Setup and Basic Administration, connect to your Office 365 tenant via PowerShell.

How to do it…

1. Enter the following command into your PowerShell or ISE window to return a list of all Office 365 users:

   Get-MsolUser

   This will give the following output:

   Figure 3.2 – PowerShell screen...

Changing a user password

While it is typically best to allow a user to set their own password, there are times where an admin needs to take over and set a user's password on their behalf (for example, service accounts, terminated users, or a new user who is struggling to get their password properly set).

While it is a typical best practice to have a user immediately change their password once set, this recipe focuses on the admin setting the password and not forcing the user to reset the password upon the next login.

Getting ready

Using the skills learned in the Setting up the PowerShell environment recipe from Chapter 1, Office 365 Setup and Basic Administration, connect to your Office 365 tenant via PowerShell.

How to do it…

Enter the following command into your PowerShell or ISE window to change the password of a specific Office 365 user:

Set-MsOlUserPassword –UserPrincipalName "[e-mail]" –NewPassword "...

Connecting via PowerShell to SharePoint Online

SharePoint Online administration, as with basic tenant administration, can be simplified when using PowerShell commands to complete common or repetitive tasks. This recipe provides the steps to set up your PowerShell console to use SharePoint Online cmdlets and functions.

Getting ready

Using the skills learned in the Setting up the PowerShell environment recipe from Chapter 1, Office 365 Setup and Basic Administration, connect to your Office 365 tenant via PowerShell.

To access SharePoint Online PowerShell cmdlets and functions, you must download and install the SharePoint Online Management Shell (link included in the See also section of this recipe).

How to do it…

There are a set of numbered, sequential tasks that the reader needs to perform in order to complete the recipe:

1. Download and install the SharePoint Online Management Shell.
2. Import the module using the following code snippet:

   Import-Module...

Creating a SharePoint site collection

Creating a new SharePoint site collection is a basic SharePoint administration task. This recipe covers how to complete that task with a few lines of PowerShell.

Getting ready

Using the skills learned in the Setting up the PowerShell environment recipe from Chapter 1, Office 365 Setup and Basic Administration and the Connecting via PowerShell to SharePoint Online recipe in this chapter, connect to your Office 365 tenant via PowerShell.

How to do it…

1. Update the URL, Owner, and Title parameters as appropriate, then run the following code snippet:

   New-SPOSite -Url https://natechamberlain.sharepoint.com/sites/PowerShell -Owner [e-mail] -StorageQuota 1000 -Title "PowerShell Site" 

2. The site will be generated, but this can take some time. Wait until the PowerShell console has completed the task.
3. To verify that the site has been created, use the Get-SPOSite cmdlet learned in the previous recipe...

Adding a new site collection admin to all SharePoint Online sites

Administration of sites requires having a certain level of access for a site collection. Users with the SharePoint Admin role have full control access to all sites, but there may be a reason to give a user without an Admin role elevated SharePoint access (for example, a site developer). This recipe explains how to give an admin access to all SharePoint Online sites. However, it can be amended to give such access to specific site collections, or a single site collection.

Getting ready

This recipe will utilize the skills learned in the Setting up the PowerShell environment recipe in Chapter 1, Office 365 Setup and Basic Administration, and the Connecting via PowerShell to SharePoint Online recipe in this chapter, and require that you are a global or SharePoint admin.

How to do it…

Update the -LoginName parameter, and then run the following code snippet:

$Sites = Get-SPOSite -Limit ...

Restoring a deleted OneDrive site

When a user is deleted from an Office 365 tenant, that user's OneDrive site is also deleted (depending on the retention policy set by the tenant admins). This recipe will explain how to recover that deleted OneDrive site.

Getting ready

Using the skills learned in the Setting up the PowerShell environment recipe in Chapter 1, Office 365 Setup and Basic Administration, and the Connecting via PowerShell to SharePoint Online recipe in this chapter, connect to your Office 365 tenant via PowerShell.

The admin restoring the OneDrive site must be assigned the Global admin or SharePoint admin role.

Finally, the admin must have the URL of the deleted OneDrive site. This can be found by checking the Deleted Sites recycle bin with the following code snippet:

Get-SPODeletedSite -IncludeOnlyPersonalSite | FT url

You can verify you have the correct URL with the following code snippet:

Get-SPODeletedSite -Identity "https://natechamberlain...

Hiding Office 365 groups from the Global Address List

Managing data and access to that data is a core component of tenant administration. In Office 365, groups have become a critical component of effective collaboration. However, this means the list of Office 365 groups can become long and, at times, confusing for users.

Trimming which groups show in the Global Address List (GAL) can help users find and connect with the right people in their organization. Additionally, some groups may require additional security or confidentiality even around its existence (for example, merger and acquisition projects, executive committees, and so on).

In this recipe, we'll restrict certain Office 365 groups from the GAL.

Getting ready

Using the skills learned in the Setting up the PowerShell environment recipe in Chapter 1, Office 365 Setup and Basic Administration, connect to your Office 365 tenant via PowerShell.

The cmdlets for interacting with Office 365 groups are found...

Preventing external senders from emailing internal Office 365 groups

This recipe will cover how an admin can prevent external parties from emailing internal Office 365 groups, which can have their own email address and shared mailbox.

Getting ready

You must be a global admin to perform these steps.

How to do it…

Update the -Identity parameter with the display name of the group you wish to change, and then run the following code snippet:

Set-UnifiedGroup -Identity "Test" -RequireSenderAuthenticationEnabled $true

How it works…

You've just protected an Office 365 group's inbox from unwanted external emails. Setting the -RequireSenderAuthenticationEnabled property on a group allows only internal users to send an email to that group. If external users send a message to the group's email address, that message will be rejected. Internal users are still able to send externally, unless other restrictions are put in place.

...