Significant Improvements in Azure AD Connect

Microsoft just announced that the Azure AD Connect sync V2 endpoint API (public preview) is now available. This new endpoint improves the performance of synchronizations to Azure Active Directory, especially during the exports and imports that happen during sync.

Even though the new V2 endpoint is in public preview, customers can deploy this in their production environments.

For large enterprises, the new endpoint also supports syncing groups with up to 250K members. The previous limit for the V1 endpoint is 50K members. However it's important to know that the new endpoint doesn't have a configured group size limit for Office 365 groups that are written back to Active Directory. For this reason, Microsoft recommends increasing O365 groups incrementally if member size was previously a blocker for your org.

You will need to deploy Azure AD Connect version 1.5.30.0 or later to use the V2 endpoint. Microsoft recommends using a swing migration for deploying the V2 endpoint, where you deploy the V2 endpoint to your staging server, validate it, and then switch over to the staging server. Then you can update your main AAD Connect server to Azure AD Connect version 1.5.30.0. Read the full guidance here.

Switching to the new V2 endpoint is performed via PowerShell.

Set-ADSyncScheduler -SyncCycleEnabled $false
Import-Module 'C:\Program Files\Microsoft Azure AD Sync\Extensions\AADConnector.psm1'
Set-ADSyncAADConnectorExportApiVersion 2
Set-ADSyncAADConnectorImportApiVersion 2
Set-ADSyncScheduler -SyncCycleEnabled $true 

If you have large groups you will need to manually reconfigure the Out to AAD – Group Join sync rule before re-enabling the sync scheduler. See the deployment guidance document for details.

Read more ...

Office 365 Begins Force-Feeding Groups to Tenants

Beginning March 2017, Microsoft will begin creating Office 365 Groups for certain managers unless you opt out.

According to the support article, "Manage automatic creation of direct reports group - Admin help":

"Managers who have 2-20 direct reports, do not already have a direct reports group, and have permissions to create groups in Outlook, will automatically have a private group created for them with their direct reports. The manager will be added as an owner, and the direct reports of the manager will be added as members by default. The group will be named '<Manager's Name>'s direct reports', but that can be edited."

The article goes on to explain how to opt-out and how to identify Groups that have already been automatically created. Not to be a Luddite or anything, but I prefer that I make my own changes in my environment, thankyouverymuch.

It's important to note that these new auto-created groups are not dynamic. That means that if a manager's direct reports change for any reason (hires, fires, promotions, etc.) the direct reports group membership will not change automatically. Clearly, this new "feature" was only added to hit some metric Microsoft is measuring for Groups "adoption".

To opt-out of automatic Group creation you'll need to run some remote PowerShell. Connect to Exchange Online PowerShell and run the following cmdlet:

Set-OrganizationConfig -DirectReportsGroupAutoCreationEnabled $false

All automatically created groups have a property called Groupsona populated. To find the Groups that have been automatically created, run the following cmdlet in remote PowerShell:

Get-UnifiedGroup -ResultSize Unlimited | Where-Object {$_.GroupPersonification -eq 'Groupsona:AutoDirectReports'}

Microsoft is all about consumption these days, which is why you can expect an opt-out model as opposed to opt-in for new features. I'm interested to know how you feel about that. Use the comments section below.

Read more ...