Category Archives: Powershell

Redirecting My Documents to Box Drive, using Intune (Windows 10 MDM)

One of my customers is doing a full cloud-only pilot of Windows 10, Mobile (MDM) managed through Intune to leverage a least-infrastructure solution worldwide.

They’re using Azure AD, but opted out of Onedrive for Business and are using Box Drive instead.

To encourage their users to actually save data to Box instead of Onedrive or locally, I wrote a little Powershell script (since Intune native PS script deployment isn’t live yet).  This script checks if Box has been configured, if not it throws a little popup to the user. If it has, it redirects My Documents, and copies any existing content from it to Box.

I used Advanced Installer to wrap this in an MSI for easy deployment through Intune, and would like to share this with you 🙂

ZIP download:

Zip contents:

  1. ps1 file which does the actual work
  2. vbs wrapper to run it silently (hidden windows)
  3. .aip file (advanced installer)
  4. .msi file (to roll out with Intune or other tools)

Update 10/10:

  1. added a caching mechanism to force Box Drive to locally cache files (normally Box only does this when they are opened)
  2. added a caching filter to prevent caching of files above 25MB to reduce initial bandwidth overhead

Update 04/12:

  1. added a 5 minute loop / wait cycle to allow box to initialize, as the script may otherwise run before Box can initialize

On-Demand MSI customization using Azure Functions

This post describes how you can use the WIX Toolkit or any DLL file in an Azure Function, in this case to edit an MSI file on the fly. The WIX Toolkit is free, but only runs on Windows. Azure Functions run on Windows too, isn’t that nice 🙂

So, an example use case could be my OnedriveMapper MSI file, which is installed with a configuration GUID property by an admin to customize OnedriveMapper. If that GUID was already in the MSI, no such parameter would be necessary.

Using an Azure function in a download link or http request, we could insert a GUID on the fly and create personalized MSI files on demand.

I’ll leave other applications to your imagination, let’s get started!

  1. Download the WIX toolkit (binaries)
  2. Extra Microsoft.Deployment.WindowsInstaller.dll
  3. Add it to the function files or host it at an URL somewhere. In my example, I’m hosting it at
  4. Add your MSI file to your function files or host it at an URL somewhere. In my example, I’m hosting it at
  5. Add the following code to the Azure Function:

Continue reading On-Demand MSI customization using Azure Functions

Provisioning Exchange Online / Office 365 Custom Roles automatically from Okta

Natively, when connected to Office 365, Okta allows you to automatically provision users and/or groups. Additionally, Okta will assign licenses you select, and if configured, set predefined roles in Office 365. This means you have one locus of control, very nice.

Then, Exchange Online allows you to define custom roles where you can scope permissions for your users with far greater granularity compared to the default roles, Okta won’t detect or provision users into these custom roles.

As this was a business requirement for a customer, I coded up a small proof of concept you can schedule that will read membership of selected groups in Okta through the Okta API, then ensure that ONLY those members are in the matching role groups in Exchange Online.

Continue reading Provisioning Exchange Online / Office 365 Custom Roles automatically from Okta

Creating a Dynamic Group using the Graph API

Azure has a very nice feature called ‘Dynamic Groups‘. We use these in our customer tenants to dynamically generate a group with actual users, excluding Guest accounts (marked with #EXT#).

As I couldn’t find any articles detailing how to create a Dynamic Group through the Graph API, I’m posting this for whoever it helps 🙂

$dynamicGroupProperties = @{
    "description" = "Dynamic Group Created through the Graph API";
    "displayName" = "Dynamic Group Created through the Graph API";
    "groupTypes" = @("DynamicMembership");
    "mailEnabled" = $False;
    "mailNickname" = "testnickname";
    "membershipRule" = "(user.userPrincipalName -notContains `"#EXT#@`") -and (user.userType -ne `"Guest`")";
    "membershipRuleProcessingState" = "On";
    "securityEnabled" = $True

invoke-webrequest -Headers $headerParams -uri "" -Body (ConvertTo-Json $dynamicGroupProperties) -method POST -Verbose

If you’re not yet used to working with the Graph API, read up on how to connect to the Graph API using Powershell.

Powershell Lock Function

A handy Powershell function to lock / unlock using .NET, to prevent concurrent read/writes to files or anything else you like.

function handleThreadLock{
        #register a thread lock
        $script:threadLock = New-Object System.Threading.Mutex($false, $lockName)
        $waited = 0
            try{$lockState = $script:threadLock.WaitOne(1000)}catch{$lockState=$False}
                if($waited -gt $timeOut){
                    Throw "failed to get a thread within $timeOut seconds!"
        #release a thread lock

In your script, call it like this:

    handleThreadLock -setLock
}catch{Throw "Failed to set lock!"}

    add-content -Path "c:\yourfile.txt" -Value "log entry" -ErrorAction Stop
    handleThreadLock -releaseLock