UPDATE: script update to enable Azure MFA and correct a bug in the Office 365 role update function
Office 365 Role membership management is one of the few workload you can not manage using groups.
To automate the membership of these roles I have created a script.
The script is comparing Active Directory group membership with the corresponding Office 365 Role, excluding online account added to the Office 365 role. If there is any difference, the script will automatically grant or revoke role membership based on the AD group.
To take advantage of this script you need the following requirements:
NOTE the script will only work with existing AD group matching the Office 365 role
The script can be executed manually or used with a scheduled task; if you use it with a schedule task, you have to manually run it once to generate all the required credentials to connect to Office 365.
There are few variables you have to update to match your environment
After updating the above variables, just run the script.
You will be prompted if you want to save the credentials to connect to Office 365 and the SMTP server.
Whatever your decision you will be prompted for your credentials but if you choose to save them, 3 or 6 encrypted files will be generated to save the account, the password and the encryption/decryption key. 3 files are used for each credentials.
If you plan to use the script with a schedule task you need to manually run the script once and choose to the save the credentials.
NOTE if at any time you hit the cancel button during the authentication requests, the script will stop
If you choose to save the credentials, 3 files are generated for this credential.
Where <credential> is the service you are going to authenticate against; like office365 for Office 365 or smtp for the SMTP server.
You will not be prompted if the 3 required files for the credential already exist; if you want to ‘overwrite’, just delete one of the file
The following screenshots show the different UI you have
All actions executed by the script are logged.
If any error occurs during the execution, the error’s details are captured and saved in the log file. The notification email will show there has been an error during the execution of one step
Below a sample of the notification email and an extract of a sample log file (attached to the notification email)
You can download the script from the TechNet Script Gallery here https://gallery.technet.microsoft.com/Automatic-Office-365-Role-433d5120
Please provide any feedback or question there, thanks.
This blog is using tracking code for analytics purpose.
No personal data are stored and maintained.