May 26
Yammer – You can “clean” all new updates

I just discovered a new feature – which could be quite helpful – to ‘clean"’ (or mark as read) all new updates.

This feature is called ‘Clear new’ and is available on the top right of the updates list; to make all updates as read, and so clean them Smile, just hit it

image and after using it image

May 25
Azure – Azure AD Privileged Identity Management approval workflow now in preview

Microsoft has released a new features for Azure AD Privileged Identity Management (Azure AD PIM).

This feature is currently in preview.

You can now define an approval workflow before any role privileges are granted.

To do so you need to edit the role you want to enable the approval workflow; to do so

  • Access the Azure portal ( and go to Azure Privileged Identity Management blade to open the Azure AD Directory Role


  • Next, go the Settings section and select Privileged Roles


  • Select the role you want to enable for workflow and enable Require Approval and select the approver(s); you can select individuals or groups as approver


Once the approval workflow has been enabled for a role, approver will automatically receive a notification email to manage the request

You can view all your requests and their status from the Azure AD PIM portal


End-users which have been set as eligible for a role can then request to activate the role from the Azure Portal and fill the justification to get the role activated


The approver(s) automatically receive a notification and can then approve/deny the request


May 16
Office 365 / Azure – New version of Azure AD Connect; now synch Public Folders

A new version of Azure AD Connect has been released (version 1.1.524.0) and apart of many bug fixes, there is a lot of improvements.

One of them is the ability to synch Exchange Mail Enabled Public Folder.

You can download the new version here


Please note that there will be a full synchronization after the upgrade because of schema updates.

This does not create public folder in Exchange Online; it just makes your On Premises Mail Enabled Public Folders available in the directory based edge blocking (see You also need to ensure the Microsoft Exchange System Objects is selected for synchronization.

May 13
OneDrive – Files on Demand is getting back

You may don’t know what means ‘files on demand’ with the OneDrive/OneDrive for Business client.

This is the functionality which used to be available with the OneDrive client back in the Windows 8.x years. This feature allows you to not synchronize a folder/file in your client but was still displayed in the Windows Explorer. This feature (for some reasons) has since being retired which generates lot of requests/complaints.

So good news, Files on Demand is back by popular demand Smile

It has been announced at the Build 2017 conference earlier last week and it will be delivered with the Windows 10 Fall Creators update.


May 13
Office 365 – Advanced Threats Protection, Safe Links is coming to Office documents

As you may already know Safe Links is a security feature on Office 365 which rewrites URL’s embedded into emails to check if these URL’s are safe which comes with Office 365 E5 (or if you have bought the add-on Advanced Threats Protection).

Now, Safe Links is coming to Office documents, performing the same ‘on the fly’ rewrite when the user click on an URL embedded into a Word, PowerPoint or Excel document.

To take advantage of this security feature, you need to have the latest Office 365 Pro Plus (ie Click to Run) version and you need to turn on Safe Links for Office from the Compliance portal ( in the Threats Management\Safe links section.

May 13
Azure – Azure Cloud Shell Preview

A new feature has been introduced on Microsoft Azure: Azure Cloud Shell.

Cloud Shell is a browser-based shell to manage Microsoft Azure.

To know more about it go and

May 05
Office 365 – RMS encrypted messages can now be decrypted on the fly with eDiscovery

A new functionality for eDiscovery is now available and enabled by default to automatically decrypt RMS encrypted messages when you are exporting the search result.


The decryption capability is automatically added to the eDiscovery Manager group.

RMS encrypted messages are decrypted ONLY when exported as individual message; if you export your search result to a PST file, they will remain encrypted.

This decryption capability does not apply to encrypted mails with OME (Office 365 Message Encryption) or to any files attached to the RMS mail – attachments will remain encrypted.

You can manage the decryption capability assignment by using the new role RMS Decrypt


May 05
Office 365 – Preview of the Visio creation capabilities

After adding the capability of opening Visio files on the web, Microsoft is now going one step further by adding the capability to create Visio file on Office 365.

Currently, it's is only available in English-US.

To join the preview, register at

Apr 21
Office 365 – Script to automate Office 365 Role membership

UPDATE: script update to enable Azure MFA and correct a bug in the Office 365 role update function

Office 365 Role membership management is one of the few workload you can not manage using groups.

To automate the membership of these roles I have created a script.

The script is comparing Active Directory group membership with the corresponding Office 365 Role, excluding online account added to the Office 365 role. If there is any difference, the script will automatically grant or revoke role membership based on the AD group.



To take advantage of this script you need the following requirements:

NOTE the script will only work with existing AD group matching the Office 365 role

  • Active Directory user accounts used to manage the role permission are synchronized
  • All accounts have a routable UPN – i.e. not using @domain.local. If not you will got the error “Access Denied. You do not have permissions to call this cmdlet.” when updating Office 365 role
  • Use an account with Office 365 Global Administrator; it will be needed to update Office 365 role membership.If you plan to use the script with a scheduled task you need to use a service account with the password set to never expire
  • A service mailbox you can authenticate with to send email notifications after completion

Script Usage

The script can be executed manually or used with a scheduled task; if you use it with a schedule task, you have to manually run it once to generate all the required credentials to connect to Office 365.

Script Variables

There are few variables you have to update to match your environment

  • $ScriptFolder defines the folder location where the script is saved; set by default to C:\Scripts. It is optional to update. All encrypted credentials files and log files will be saved in this directory
  • $GroupOU defines the organizational unit where the AD groups used for Office 365 Role management are located; this OU does not need to be synchronized with Office 365. For example, $GroupOU = "Office 365 Roles Management"
  • $MFAEnabled defines if you want to enable Azure MFA; the script will ask if you want to enable or not Azure MFA – if you do not answer within 20 seconds it will apply the default (MFA enabled); this helps the script to detect if it is running interactively or with a scheduled task
  • $SMTPServer to define the SMTP server to use for sending email notification. For example, $SMTPServer = ""
  • $SMTPPort to define the communication port to use to connect to the SMTP server – usually 25 or 587
  • $From defines the FROM field of the email notification; it does not need to be an existing email address
  • $To defines the recipient for the notification. If you want to define multiple recipients, separate each recipient with a coma. For example, $To = "",""


Manual Execution

After updating the above variables, just run the script.

You will be prompted if you want to save the credentials to connect to Office 365 and the SMTP server.

Whatever your decision you will be prompted for your credentials but if you choose to save them, 3 or 6 encrypted files will be generated to save the account, the password and the encryption/decryption key. 3 files are used for each credentials.


Use with a scheduled task

If you plan to use the script with a schedule task you need to manually run the script once and choose to the save the credentials.

NOTE if at any time you hit the cancel button during the authentication requests, the script will stop


Saved credentials

If you choose to save the credentials, 3 files are generated for this credential.

  • <credential>_account.txt is the encrypted file containing the user account
  • <credential>_password.txt is the encrypted file containing the password
  • <credential>_key.key is the encryption/decryption key

Where <credential> is the service you are going to authenticate against; like office365 for Office 365 or smtp for the SMTP server.

You will not be prompted if the 3 required files for the credential already exist; if you want to ‘overwrite’, just delete one of the file


User Interface

The following screenshots show the different UI you have

Prompt to save credential Credentials not being saved Credential being save  
    User account prompt Password prompt
image image image image
image image image image
Prompt to enable Azure MFA      
image This pop up is “time bombed”; if you do not answer within 20 seconds the default settings (MFA enabled) is applied.
This allows the script to detect if it is running interactively or with a scheduled task


Log file and notification

All actions executed by the script are logged.

If any error occurs during the execution, the error’s details are captured and saved in the log file. The notification email will show there has been an error during the execution of one step

Below a sample of the notification email and an extract of a sample log file (attached to the notification email)



Getting the script

You can download the script from the TechNet Script Gallery here

Please provide any feedback or question there, thanks.

Apr 15
Yammer – It is now possible to edit a post

It has been a long awaited and requested feature. Now it is finally possible to edit a post on Yammer.

This will be first available when using a web browser, and then will also come to the iOS or Android app.

With this feature, each time you edit a post, a new version is being created. If you need (as an administrator) to export the content, all version will be exported.

It is important to note that editing attachments or external group post is not yet available.

The Edit button will appear just beneath your post; it will be also available for your previous post


Once your post has been edited once, a Edited tag will be displayed and will allow to view the version history


1 - 10Next

 ‭(Hidden)‬ Blog Tools


Benoit is specialized on Microsoft infrastructure (Active Directory, Azure, ForeFront products, Hyper-V, Identity Management, System Center, Windows) and collaboration (BPOS, Exchange, Office 365, SharePoint, Lync/Skype for Business) technologies.

He has been awarded as Microsoft Most Valuable Professional (MVP) since 2002 - on Windows, then SharePoint and finally Office 365. He has been recoginzed as Microsoft Community Contributor for his work on the Office 365 community in 2013 and 2014.

He has been involved in early stage of testing phase for many Microsoft products - from Windows to Office 365, including Exchange, SharePoint or Office client and WindowsUpdate.

He has participated as speaker or Ask The Expert (ATE) at many Microsoft or Quest events. He also participed in writing several books on SharePoint (2003 to 2010).

With more than 10 years of professional experience, he has a deep knowledge of the Microsoft market and his competitors.


​Privacy Information

This blog is using tracking code for analytics purpose.

No personal data are stored and maintained.

 Follow me on

 Share This

 Office365 Undercover by Arnaud ALCABEZ

Retrieving Data


Microsoft Certified Systems Administrator 
Microsoft Certified Systems Administrator - Messaging
Microsoft Certified Systems Engineer 
Microsoft Technology Specialist 
 Microsoft Certified IT Professional

 Translation Tool

Translate this page

 FaceBook Fan's Page

 Books I wrote

Le portail Microsoft SharePoint 
Microsoft Office SharePoint Portal Server 2003 et WSS au quotidien 
Microsoft Office SharePoint Server (MOSS) et Office 2007  
Microsoft Sharepoint 2010