Category Archives: Powershell

CSP access to tenants using powershell. Part 2

In part 1 we created the Azure Enterprise App for Partnercenter and used this information to connect using powershell and connect-partnercenter. Now we will use this to connect to one of our customers tenants. First we will use AZ module and connect-azaccount. We will use the AZ module and the partnercenter module. So if those at not installed please install :


install-module az
install-module partnercenter

I will use the partnercenter module to request an accesstoken for azure.


$app=get-credential # Get AppID and Key for out partnecenter app. (created in part 1)
$refreshtoken = 'refreshtoken' # From part 1 or whenever we get a new one.
$CustomerTenantID= 'Azure directory object id'

Now we have all the required info to connect. The credentials should be stored securely!!!!


$azureToken = New-PartnerAccessToken -Resource https://management.azure.com/ -Credential $app -RefreshToken $refreshtoken -TenantId $CustomerTenantID

$grapToken = New-PartnerAccessToken -RefreshToken $refreshToken -Resource https://graph.windows.net/ -Credential $app -TenantId $CustomerTenantID  

Connect-AzAccount -AccessToken $azureToken.AccessToken -GraphAccessToken $graphToken.AccessToken -TenantId $CustomerTenantID  -AccountId $app.username

There. We are now connected to our azure of our customer. In next part we will connect to azureAD

CSP access to tenants using powershell. Part 1

A short explanation of how to access customer tenant using a CSP tenant SPN credential connectiong to AzureAD and AZ. Have been struggling for a while to manage all our customers tenants using powershell scripts. It can be complicated to organize all the credentials, tenant domain, tenant id’s password expiry.

First step is to be able to use powershell in the CSP tenants and access the partnercenter module. To get this started Microsoft has published a script to create the SPN required for this. https://docs.microsoft.com/en-us/powershell/partnercenter/secure-app-model?view=partnercenterps-1.5 This script will help you create the SPN . When using the SPN for the first time you will have to consent it using an admin account. The “ConfigurePreconsent” argument adds the spn to the adminagents group, this result in the account being a global admin in the customer tenants. Next:


$credential = Get-Credential
$token = New-PartnerAccessToken -Consent -Credential $credential -Resource https://api.partnercenter.microsoft.com -TenantId 'Your Tenant Id'

This is to consent the spn and get the refresh token we will in further logins. TenantId is the ID of your partner tenant. First it asks for the credential of the newly created spn (appID and key), next it will require you to login and consent using a service account . In return you get a token. Remember to store the refresh token part in a secure place as this will be used in our next login.


$refreshToken = 'Enter the refresh token value here'
$credential = Get-Credential
$tenantId = 'Your Tenant Id'
$pcToken = New-PartnerAccessToken -RefreshToken $refreshToken -Resource https://api.partnercenter.microsoft.com -Credential $credential -TenantId $tenantId
Connect-PartnerCenter -AccessToken $pcToken.AccessToken -ApplicationId $appId -TenantId $tenantId

Here we connect to partnercenter. We got the $refreshtoken in the previous step. $credential is our appid and key returned from the script. $tenantid is the tenantid of the partner tenant. Returned from the connection is a new $pcToken. This $pcToken includes a new refresh token that we could store and use at next login, but the one we already got would still last for a default value of 90 days. We’ve had some issues it the MFA settings in the tenant allow the user to “not be asked for credentials in xx days” (So we always uncheck this box).

Part 2 will for the AZ connection to customer tenant.

List Exchange mailboxes with forwarding rules

Simple list of all mailboxes and rules. Displays more info if one of them contains a forwarding rule:

$mb=Get-Mailbox | Sort-Object -Property displayname
$t2=0;$t=($mb).count;$mb| ForEach-Object {write-host $t2"\"$t " " $_.displayname;$t2++;get-inboxrule -mailbox $_.alias| ForEach-Object {if($_.description -like "*forward*"){write-host $_.description -foregroundcolor red}}}

S4B – Error preparing forest.

Was installing a Skype for Business server the other day, and the simple task of preparing the forest failed. I am always on the alert when doing Active Directory forest wide tasks as prepare schema and prepare forest, so it is not fun to see error messages during these tasks.

prepareforestWhat now. It is no good feeling to see “Unrecoverable” and “You cannot retry this operation”. But I had to retry, and then there was a slight different error message.

prepareforest2I’ve had errors before, and at those cases the simple thing to do was to change from  “Local domain” to “Domain FQDN” in the “Universal Group Location” dialog box.

prepareforest3

This time there was nothing but lots of scary errors.

I know this domain has several trusts configured, so it looks like the wizard get confused of where to  put these groups. Next step was to run prepare forest from PowerShell so that I was able to provide all this information to the command.

Enable-CsAdForest -GroupDomain s4b.local -GroupDomainController s4b-dc1.s4b.local -GlobalCatalog s4b-dc1.s4b.local

And finally success. The command completed without warnings and errors.

Forwarding email in Exchange

One common question from users are “How can I forward my email to my home mail?” or from a manager “How can we forward his/her mail to the external address?”. In fact in Exchange there is several possibilities, but most of them requires some administrator involvement. For users to forward their own email an administrator would have to allow it.

Users could define a forward using outlook. This requre the administartor to allow it. The administrator will have to set “AutoForwardEnabled” on “Remote Domain” : Set-remotedomain “*” -AutoForwardEnabled $true . This will ofcourse enable this for all users. They will be enables to send to det remote domain defined or all.

As an administrator you could create an exchange contact and sett this as forwarding on the mailbox in the EMC. Mailbox properties and mailbox features -> Mail flow ->delivery options: forward_emc1

forward_emcHere you can select an allready created Mail contact.

It can also be done from PowerShell, here you have one more option.forwardingaddress forwardanddeliverHer we can specify either a contact or a smtp address, but you can not use both at the same time.

set-mailbox demouser -forwardingsmtpaddress [email protected] -delivertomailboxandforward $true

This will sett forwarding for mailbox with alias demouser to [email protected] , and also deliver mail to both the forwarding address and the mailbox. One thing to notice is that for this to work you will have to add “dom.ex” as a remote domain in exchange.

 

 

IMAP disabled in Exchange 2013 ServerComponentState.

IMAP was enabled on the Exchange  server and had been used for a long time. One day the Exchange server’s IP subnet was placed in a Active Directory site without any Domain Controllers. Of course  Exchange the services stopped running after a while. When We managed to get it back to its original site and rebooted, everything looked OK.  But IMAP did not work. The Client software gave us the error “Invalid filed description”.

Tried to run “Test-ImapConnectivity” , error stated Authentication Failed . Verified account by successfully logging on to OWA. Reset password to be sure, same error.

Continue reading IMAP disabled in Exchange 2013 ServerComponentState.