I’ve been using Azure Runbooks for a long time now, but when you want to ‘really’ use them in an enterprise environment, they simply do not suffice. Vote for this suggestion if you feel same:
Provide more control of how runbooks are allocated to a sandbox
One of my customers is doing a full cloud-only pilot of Windows 10, Mobile (MDM) managed through Intune to leverage a least-infrastructure solution worldwide.
They’re using Azure AD, but opted out of Onedrive for Business and are using Box Drive instead.
To encourage their users to actually save data to Box instead of Onedrive or locally, I wrote a little Powershell script (since Intune native PS script deployment isn’t live yet). This script checks if Box has been configured, if not it throws a little popup to the user. If it has, it redirects My Documents, and copies any existing content from it to Box.
I used Advanced Installer to wrap this in an MSI for easy deployment through Intune, and would like to share this with you 🙂
ZIP download: configureBoxRedirection_v1.02.zip
Zip contents:
Update 10/10:
Update 04/12:
This post describes how you can use the WIX Toolkit or any DLL file in an Azure Function, in this case to edit an MSI file on the fly. The WIX Toolkit is free, but only runs on Windows. Azure Functions run on Windows too, isn’t that nice 🙂
So, an example use case could be my OnedriveMapper MSI file, which is installed with a configuration GUID property by an admin to customize OnedriveMapper. If that GUID was already in the MSI, no such parameter would be necessary.
Using an Azure function in a download link or http request, we could insert a GUID on the fly and create personalized MSI files on demand.
I’ll leave other applications to your imagination, let’s get started!
Continue reading On-Demand MSI customization using Azure Functions
Natively, when connected to Office 365, Okta allows you to automatically provision users and/or groups. Additionally, Okta will assign licenses you select, and if configured, set predefined roles in Office 365. This means you have one locus of control, very nice.
Then, Exchange Online allows you to define custom roles where you can scope permissions for your users with far greater granularity compared to the default roles, Okta won’t detect or provision users into these custom roles.
As this was a business requirement for a customer, I coded up a small proof of concept you can schedule that will read membership of selected groups in Okta through the Okta API, then ensure that ONLY those members are in the matching role groups in Exchange Online.
Continue reading Provisioning Exchange Online / Office 365 Custom Roles automatically from Okta
Okta exposes a very useful API, with which I’ve been working for a while to ensure business fit for certain scenario’s that Okta and/or Office 365/Azure don’t fully support yet.
One of those scenario’s requires information about certain groups and their members. I’m narrowing the selection down to just pure Okta groups, but any groups (e.g. AD Synced) can be returned with below code by adjusting the filter in the retrieveAllOktaGroups function.
Continue reading How to retrieve all Okta groups including their members using Powershell
I recently ran into an article by Pieter Wigleven, based on an original idea of Jan Van Meirvenne that I simply have to share, and expand upon.
When you go cloud first, and do light MDM management of your Azure AD Joined Windows 10 devices, you will likely enable a Bitlocker policy in Intune. What you’ll quickly discover, is that your policy will not automatically enforce/enable Bitlocker on non-InstantGo capable devices.
So, I expanded upon Jan and Pieter’s script to automatically enable Bitlocker on Windows 10; it has additional error handling, local logging and it will eject removable drives prior to immediately (vs reboot) encrypting your system drive. After this is started, it will register your recovery key in AzureAD. Of course all credit for the original idea goes to Jan van Meirvenne.
Powershell source file
enableBitlockerAndRegisterInAAD_v0.04.ps1 (right click, save as)
MSI file
enableBitlockerAndRegisterInAAd_v0.04.msi (right click, save as)
As Intune won’t let you deploy a Powershell script, I’ve also wrapped the script in an MSI file with Advanced Installer for you. What this will do;
Advanced installer package (.aip)
enableBitlockerAndRegisterInAAD.zip (right click, save as)
Requirements
Version 0.56 is out, changes since v0.50:
Get it here
Some Windows services can be triggered to start at certain events. These services have ‘Tigger Start’ in their startup name behind whatever you configured (like Manual).
Powershell does not have a native method to register the type of event that triggers such a service, C++ and C# do…..and Powershell can natively run C#.
To trigger a service, you’ll need its guid first:
run sc triggerinfo <SERVICENAME>
This will give you a GUID, for example for the WebClient service:
22b6d684-fa63-4578-87c9-effcbe6643c7
You can then use this GUID in the following script to trigger your service from Powershell 🙂 Continue reading How to start a “Trigger Start” windows service with Powershell without elevation / admin rights
Are you using aadconnect, but want your users to be able to update your Office 365 distribution lists directly in OWA (Outlook Web Access)? And still keep them in sync with your Active Directory?
Then stay tuned 😉
Version 0.9 of O365Migrator is now available as a free download.
What was changed?
You can find the new version here.