In the post-Onedrivemapper era where we have Files On Demand, there is still room for improvement in client side configuration of Onedrive for Business. Onedrive Known Folders isn’t up to par yet, doesn’t support any customization and there are situations where I want to be able to redirect local folders to other places than Onedrive like Teams or Sharepoint.
Therefore I present to you “Invoke-O4BAutoMount“; the ultimate Onedrive/Sharepoint/Teams sync and redirect solution in modern workplace scenario’s, no WebDav, just the NSG Onedrive Client and native Intune Management Extension:
The PowerBI Import API is quite specific and kept giving me 400’s like:
“Bad Request” with no details
UnknownError pbi.error exceptionCulprit 1 (loved this one)
MultiPartMimeStreamFormatException
RequestedFileIsEncryptedOrCorrupted
Eventually I figured out how to import my reports directly into PowerBI, so to help you automate importing your reports into workspaces or directly to customers using PowerShell, I’ll share my PowerShell function with you:
With Intune’s new Bitlocker Encryption Report administrators have an effective way of seeing which of their devices have been encrypted.
But if we want to know if we can actually recover the bitlocker key of a device, we need to know if it was ever uploaded to AzureAD.
Network or local device issues can sometimes prevent the recovery key from reaching AzureAD, resulting in lost data if the device’s disk needs to be recovered for any reason. To hunt down devices that have not escrowed their recovery key to AzureAD, you can use my report function (in PowerShell as always):
Azure AD allows us to assign licenses to groups, a nifty feature that has made a host of automation scripts dealing with bulk license assignment obsolete.
A problem I’ve encountered is that when you assign users to a group, license assignments are not processed right away, especially if you didn’t have enough licenses when you assigned the user to the group (and added licenses to the tenant later).
Azure AD has a button to trigger an update manually:
But of course, this can also be automated with PowerShell!
function Invoke-AzHAPIReprocessGroupLicenses{
<#
.SYNOPSIS
reprocesses group license assignment
.NOTES
Author: Jos Lieben
.PARAMETER AzureRMToken
Use Get-azureRMToken to get a token for this parameter
.PARAMETER groupGUID
GUID of the group to reprocess licenses of
Requires:
- Global Administrator Credentials (non-CSP!)
- AzureRM Module
- supply result of get-azureRMToken function
#>
param(
[Parameter(Mandatory = $true)]$AzureRMToken,
[Parameter(Mandatory = $true)]$groupGUID
)
$header = @{
'Authorization' = 'Bearer ' + $AzureRMToken
'X-Requested-With'= 'XMLHttpRequest'
'x-ms-client-request-id'= [guid]::NewGuid()
'x-ms-correlation-id' = [guid]::NewGuid()
}
$url = "https://main.iam.ad.ext.azure.com/api/AccountSkus/Group/$groupGUID/Reprocess"
Invoke-RestMethod –Uri $url –Headers $header –Method POST -Body $Null -UseBasicParsing -ErrorAction Stop -ContentType "application/json"
}
I often need a tenant ID for a given customer, the usual method to get it is to log in to the Azure portal and find it there. But what if you want to get the tenant ID programmatically? Without actually logging in? And you only know the log in name of a user? Or just one of the customer’s domain names?
Then this’ll help you out!
function get-tenantIdFromLogin(){
<#
.SYNOPSIS
Retrieves an Office 365 / Azure AD tenant ID for a given user login name (email address)
.EXAMPLE
$tenantId = get-tenantIdFromLogin -Username you@domain.com
.PARAMETER Username
the UPN of a user
.NOTES
filename: get-tenantIdFromLogin.ps1
author: Jos Lieben
blog: www.lieben.nu
created: 8/3/2019
#>
Param(
[Parameter(Mandatory=$true)]$Username
)
$openIdInfo = Invoke-RestMethod "https://login.windows.net/$($Username.Split("@")[1])/.well-known/openid-configuration" -Method GET
return $openIdInfo.userinfo_endpoint.Split("/")[3]
}
Obviously, you can also get the tenant ID by just filling out bogus info in front of the user’s login (e.g. bogus@ogd.nl), it’ll still work as only the domain part of the login is really used.
