Office 365 Pro Plus and Visio or Project Co-Existence

Office 365 co-existence with volume licensed products is something which has been a bone of contention for many Office 365 users. Traditionally, an enterprise, we have installed Office 2016 ProPlus using a Windows Installer package. The license for this would have come from your Enterprise Agreement (EA) and would typically be licensed using a KMS host. When you move to Office 365, this model changes. These changes can have a major impact on Project and Visio applications for some customers.

To read out what the changes are and how we can work with them, read on below the fold.

Read the Full Post

Office 365 Group License Management Preview

Sitting on the train yesterday evening, I was glancing across my Twitter feed when I noticed this beauty that I had to share.

https://blogs.technet.microsoft.com/enterprisemobility/2017/02/22/announcing-the-public-preview-of-azure-ad-group-based-license-management-for-office-365-and-more/

Granted, the feature may be in preview right now so doesn’t quite have it’s game face on just yet but it’s still really worth looking at.

You now have ability to assign Office 365 licenses based on either Azure Active Directory or on-premise synchronised Active Directory group membership (a security group to be specific). No longer do we need to assign the licenses to each user individually or use PowerShell scripts to bulk assign the membership. Simply assign the proper licenses to the group and then make sure everyone is a member of that group. When a user is added to the group, they get the licenses and when the user is removed from the group, they get the licenses taken away, simples.

This may seem like a small feature but for customers’ adopting Office 365 from scratch or for existing customers who are buying up new features or activating license sub-components as part of a progressive Office 365 rollout, this will be an invaluable time saver. You can even have multiple groups and use dynamic group membership to have the groups populated based on attributes of a user object.

I see a real use case for this group based license assignment in scenarios where you have a limited number of licenses available for a particular product and you need to re-assign them from one individual to another. A would be a great example where one department need to use Power BI Pro but another does not and as a users’ department attribute changes from Sales to Operations (as an example), the licenses get moved around. For customers automating their starter and leaver processes, no longer will you need PowerShell Cmdlets which connect to Office 365 and assign the licenses. Just make sure the user is created as a member of the relevant groups and off they go.

I look forward to seeing this feature go into general availability and being used by customers in the field.

Unattended Installation of Office 2016

With the release of Office 2016, Visio 2016 and Project 2016, many will want to start thinking about their upgrade. Office 2016 at present is only available in the Click-to-Run format but if the Office 365 Community is to be believed there will be an .msi based installation coming for volume license customers on October 1st.

As it happens, in Office 2016, the Click-to-Run experience is actually quite nice compared to previous instances of it and while I’ve been running the preview builds of Office 2016, I certainly haven’t seen any issues with performance so I see no reason not to use Click-to-Run now given that if you ever decide to remove Office from the machine, it will leave you with a cleaner slate.

This post is going to cover how to build an offline source and perform an unattended installation of Office 2016. This will work for Configuration Manager customers as well as customers using a manual installation process. In order to be able to perform an offline installation of Office 2016, you are going to need two things. The Office 2016 Deployment Tool and you are going to need an offline source for Office 2016. If you don’t have this already, you can generate it using the tool but I was able to get the offline source from the MSDN .iso download.

Download the Deployment Tool

First things first, go to http://www.microsoft.com/en-us/download/details.aspx?id=49117 and get the Office 2016 Deployment Tool. The installer for this doesn’t actually install an application but merely unpacks a setup.exe file and a sample configuration.xml file. I unpacked the setup.exe file to a folder on the root of my drive for easy access.

Within this folder, create sub-folders for each of the Office products you want to configure. In my case, I am doing all three: Office, Project and Visio and once you have created these folders, copy the setup.exe file to each sub-folder.

Create the Configuration Files

Once you’ve got the sample configuration.xml file, you can use this, along with the reference at https://technet.microsoft.com/en-us/library/jj219426.aspx for generating your custom configuration file. I have created three files: one for Office, one for Project and another for Visio, all of which I have included below to save you some time.

You will notice that in the Product section of these files, I have a value called PIDKEY. This PIDKEY value is where you provide your product key if you are using one. If you are using per-user licensing then you need to remove the entire PIDKEY value.

I have also opted to exclude Access, InfoPath and Publisher from my installation as I don’t have an need for these applications. A full list of applications you can exclude is available at the TechNet reference page. Another option which you may find useful is the Display Level. This can be set between Full and None. I have opted for None to make this a silent installation but you could opt for Full. Full will present the user with the UI for the installation but they will not be prompted to answer any questions. This allows the user to track the progress of the installation if you are trying to perform a passive install rather than a silent one.

Save each of the products configuration files in their relevant directory. It is worth noting that you are not obliged to name the configuration file configuration.xml and you can save this as whatever you want to call it. This allows you to maintain multiple configurations for different sets of users who require access to different Office applications.

Office 2016 Pro Plus Configuration File

<Configuration>

  <Add OfficeClientEdition="32">
    <Product ID="O365ProPlusRetail" PIDKEY="XXXXX-XXXXX-XXXXX-XXXXX-XXXXX">
      <Language ID="en-US" />
      <ExcludeApp ID="Access" />
      <ExcludeApp ID="InfoPath" />
      <ExcludeApp ID="Publisher" />
      <ExcludeApp ID="SharePointDesigner" />
    </Product>
  </Add>

  <Updates Enabled="True" />

  <Display Level="None" AcceptEULA="True" />

  <Property Name="AutoActivate" Value="1" />
  <Property Name="ForceAppShutdown" Value="True" />

</Configuration>

 Project 2016 Professional Configuration File

<Configuration>

  <Add OfficeClientEdition="32">
    <Product ID="ProjectProRetail" PIDKEY="XXXXX-XXXXX-XXXXX-XXXXX-XXXXX">
      <Language ID="en-US" />
    </Product>
  </Add>

  <Updates Enabled="True" />

  <Display Level="None" AcceptEULA="True" />

  <Property Name="AutoActivate" Value="1" />
  <Property Name="ForceAppShutdown" Value="True" />

</Configuration>

 Visio 2016 Professional Configuration File

<Configuration>

  <Add OfficeClientEdition="32">
    <Product ID="VisioProRetail" PIDKEY="XXXXX-XXXXX-XXXXX-XXXXX-XXXXX">
      <Language ID="en-US" />
    </Product>
  </Add>

  <Updates Enabled="True" />

  <Display Level="None" AcceptEULA="True" />

  <Property Name="AutoActivate" Value="1" />
  <Property Name="ForceAppShutdown" Value="True" />

</Configuration>

 Create an Offline Source

With your configuration files created and saved in your product specific sub-folders, we can proceed with creating the office source.

If you have the .iso media from MSDN or elsewhere, to do this, mount the .iso file and locate the office folder on it. Copy this office folder into the sub-folder for your specific product and then repeat this with the media for the remaining products. You should end up with three folders, one for Office, Visio and Project and inside each of these folders, you will have a folder named office, the .xml configuration file and the setup.exe file.

If you don’t have the media, we now need to download the content for offline use. Open an elevated command prompt and change the working directory to the directory where your setup.exe is located. From here, type the command setup.exe /download configuration.xml. This will start the download for the Click-to-Run components for offline use. Once it has completed, you need to repeat the process for any remaining Office products you are using.

Perform an Unattended Installation

With the configuration files and offline source ready, you can now perform an unattended installation. To do this, you simply use the command setup.exe /configure configuration.xml from the working directory containing the files. You don’t need to specify the path to the configuration file as you have put it in the same directory as the setup.exe file and you don’t need to specify the path to the offline source because it will automatically look for this in the office folder from where you launched the setup.exe file.

If you are deploying Office using Configuration Manager then you would simply copy the folders for each of your products to package source path and create applications for them within Configuration Manager. Clients will download the package source to the local cache as it does for any normal application prior to performing the installation.

Update on Product IDs

After publishing this post, I noticed that my test machine wasn’t accepting the licence key I included in the .xml file. This turned out to be because the media I used from MSDN contained not O365ProPlusRetail Product ID but instead ProPlusRetail. My recommendation here would be to perform a test installation on a test machine first to check the Product ID which gets installed from your media (if you are using any) so that you can make sure you are targeting the correct Product ID.

After updating my .xml file to use the correct Product ID, the installation started automatically entering the product key and automatically activating the products.

Managing Offline Sync in OneDrive for Business

Yesterday, I released a post explaining how we can control and manage some of the sharing capabilities of SharePoint Online. Those changes applied not only to SharePoint Online but also to OneDrive for Business such as whether or not a user can share a file publicly with an anonymous link.

In this post, I am going to focus on the offline sync capability of OneDrive for Business. This feature allows a user to have access to their OneDrive for Business files on their PC or Mac device and work on them offline and when they come back online, changes are synchronised back up to OneDrive for Business. The OneDrive for Business client allows not only syncing for offline access of a users personal site folders but also of team site folders and data. In some cases, people are even using this feature to replace their Folder Redirection shares on the local network to a file server and have users work go up to OneDrive for Business by default making the most of that 1TB per user allowance and reducing your on-premise storage management and purchasing costs. In other cases, you could use this to allow employees working remotely to have access to a central team site that contains all of your document templates or marketing collateral.

While this offline sync capability is very useful, it also comes with a price. Imagine a scenario with a disgruntled employee: Using their home PC, they login to OneDrive for Business and configure their client to sync their folders and files at home. Now, this user has copies of all of their corporate work product at home, free to take it or sell it to a competitor or such. Another scenario is that somebody gains access to your SharePoint Online environment and takes a copy of a sensitive folder of documents and then publishes them online, exposing your company.

Luckily, after all this scaremongering, we can control it although this is a new feature so it’s not something we could have done before.

Turn Off Offline Sync for a Library

The easiest way to protect sensitive content is to prevent it from being synchronised for offline access so that OneDrive for Business clients cannot take copies of it with them offline. Yes, this method as no neither of the methods given stop someone physically downloading a copy of files but it stops them doing it en-masse using the OneDrive for Business client as a bulk collection tool.

Within SharePoint Online, access the Library Settings for your particular library type and then head into the Advanced Settings section.

SharePoint Online Disable Offline Sync

As you can see, in the Advanced Settings, we have the option to disable offline sync. As I said before, this is a great option for really sensitive areas that you just flat-out do not want kept offline but it’s not ideal for your honest corporate employee nor is it very scalable as this is a per library setting so unless you want to iterate all your libraries with PowerShell or some automation tool, this will get old and very time consuming fast.

Limiting Offline Sync to Domain Clients

With this new feature for OneDrive for Business, we can now control whether or not a client is able to sync offline content based on whether their computer is a member of a given number of Active Directory domains. With this feature, we can allow our employees to sync files offline but we can limit the scope of it to our domain managed client PCs.

There are two caveats that come with this new capability. First, this is a tenant-wide setting so once you apply this, you will not be able to perform offline sync with OneDrive for Business for any library in your tenant outside of one of the configured domains. The second is in the detail in the previous paragraph – PCs. Because a domain joined Mac client is not really a fully-fledged domain member like a Windows Client OS, changing this setting disables offline sync for Mac devices regardless of whether they are joined to your domain or not. We can hope this is something that might get fixed in the future as this is the first release of this feature but we just don’t know right now.

Right now, this change does not effect or limit mobile OneDrive for Business apps in any way just as an FYI but that is where Office 365 MDM comes in to play which I will hopefully get a chance to cover in a future post.

So to get started implementing this, we first need to get the GUIDs for our domains. These are unique hexadecimal strings which uniquely identify our domain. To get the GUIDs for all of the domains in our forest, we can use the following PowerShell Cmdlets from a PC with the Active Directory PowerShell Module installed from the RSAT Tools.

Import-Module ActiveDirectory
$Domains = (Get-ADForest).Domains; ForEach($D in $Domains) {Get-ADDomain -Identity $D | Select Name, ObjectGuid}

This Cmdlet comes from the Microsoft TechNet page at https://technet.microsoft.com/en-us/library/dn938435.aspx on how to get domain GUIDs but I have added the Name column to the output. I know that it is likely in the real world that we may have resource or selected domains that we don’t want to allow sync to occur in so this way, we can see which domains relate to which GUID and we can filter them out as needed.

With the domain GUIDs in hand, we can now configure SharePoint Online. Using a PC with the SharePoint Online PowerShell Module installed, enter the following Cmdlets:

Connect-SPOService -Url https://tenantname-admin.sharepoint.com -Credential admin@domain.com
Set-SPOTenantSyncClientRestriction  -Enable -DomainGuids "786548DD-877B-4760-A749-6B1EFBC1190A; 877564FF-877B-4760-A749-6B1EFBC1190A"

So as you will be able to see in the example above, firstly, you need to change the Url parameter to match your Tenant Admin URL and you also need to enter your Global Administrator or SharePoint Online Administrator credentials. On the second line, I’ve entering the domain GUID for two domains which are semi-colon separated. If you have just one then omit the semi-colon.

Once the change is applied, users will no longer be able to sync content for offline access with OneDrive for Business unless they are using a corporate managed, domain joined machine in one of the domains you have specified or from any Mac clients. Any users who have configured offline sync with OneDrive for Business on non-domain joined machines prior to the change will stop syncing any new changes but the existing content will not be deleted from the client so it is important to implement this change early if you are starting out in Office 365 today.

 

Managing Sharing and Access in SharePoint Online

For many organisations using SharePoint on-premise, SharePoint Online is a very appealing proposition. For administrators, it’s easy to deploy as you no longer have to worry about farm topology design and sizing your SQL Server disks to meet your capacity and performance objectives nor do you have to open firewall holes left, right and centre to give your users the collaboration tools they require when they are on the move as access to your corporate SharePoint sites and OneDrive for Business is all done in the cloud.

For some organisations, SharePoint Online and it’s broad sharing capabilities will present a headache at the same time because managing the risk that comes with this open accessibility of information can add up and depending on your particular circumstances, you may want to restrict certain aspects of this to ensure that your corporate data stays safe. In this post, I’m going to address some of the things we can do to configure SharePoint Online to manage those risks using both some existing features and some newly added features.

Default Sharing Settings

By default, SharePoint is actually a pretty open book allowing your end-users to share anything with potentially anyone. We can share files with selected users within our organisation, all users within our organisation or external parties. The default configuration allows us to generate a sharing link that we can send out to third-parties and they will be able to view the file without needing to authenticate or prove who they are.

Get the SharePoint Online PowerShell Module

For this post, we are going to be working with the SharePoint Online PowerShell Module and you will need to have the latest version which includes all of the new Cmdlet parameters. To download this, you can get it from http://www.microsoft.com/en-gb/download/details.aspx?id=35588.

Connect to Your SharePoint Online Tenant

In order to use the SharePoint Online PowerShell Cmdlets, you need to be either a SharePoint Administrator a Global Administrator in your Office 365 tenant. Once you have the relevant permissions, open PowerShell and enter the Connect-SPOService to authenticate as follows:

Connect-SPOService -Url https://tenantname-admin.sharepoint.com -Credential admin@domain.com

You will be prompted to enter your password for the credential provided and once entered you will be connected to your SharePoint Online tenant. We can view the current configuration of the tenant sharing configuration using the Cmdlet Get-SPOTenant.

Restricting External User and Guest Sharing Setting

By default, SharePoint Online allows us to share with both registered external users and guest users with a link. We can control this setting with the SharingCapability parameter with the following examples:

Set-SPOTenant -SharingCapability ExternalUserAndGuestSharing
Set-SPOTenant -SharingCapability ExternalUserSharingOnly
Set-SPOTenant -SharingCapability Disabled

The top setting, ExternalUserAndGuestSharing is the default and allows sharing links to be sent to both authenticated users who sign in to access content with a Microsoft Account and guest users. The risk with this is that the links sent to guest users could be forwarded to other people once sent out or even shared publicly online exposing your content.

The second setting, ExternalUserSharingOnly allows sharing to take place but limits it to users who sign in with a Microsoft Account to access the content. Additionally, these links are one-time use which means once a user has accessed the link they will continue to be able to view that content but forwarding or outwardly sharing the link will not allow anyone else access to it without the original Microsoft Account credentials.

When applied using the above Cmdlets, this is set at the tenant level. Administrators of Site Collections within the tenant can change this setting on a per Site Collection basis however they cannot make the setting less secure that the tenant level setting. If for example, you set the tenant level setting to only allow authenticated users to access shared content, a Site Collection administrator would only be able to select between externally authenticated sharing or no sharing at all and the guest sharing option would be disabled.

We can couple the above setting for only allowing external users who are authenticated with another PowerShell Cmdlet.

Set-SPOTenant -RequireAcceptingAccountMatchInvitedAccount $True

This setting which is disabled by default but can be enabled, ensures that only the person who is sent an authenticated user sharing link can use the link. In it’s default state, a link for sharing can be sent out to a third-party user for them to authenticate with using a Microsoft Account however if they do not click the link to perform the initial binding to their Microsoft Account and instead, forwarded it to somebody else who signed in using their Microsoft Account would allow this alternate individual access to the document. Although this is quite a rare scenario to consider, it is still possible none-the-less.

For example, you send a link to dave@richardjgreen.net but Dave forwards the link to bill@richardjgreen.net and Bill opens the link and binds it to his Microsoft Account allowing Bill access to the document rather than Dave as you had intended.

This setting when enabled records the email address that the sharing link was sent to and will only allow the Microsoft Account named in the original invitation to use it and bind to it. My personal take on this is that if you are changing the default sharing behaviour to only allow authenticated user sharing then this setting is a must have.

Hiding Wide-Scoped Sharing Options

In SharePoint Online, not only can we share content externally but we can share content internally. Sometimes, especially in large organisations, this over-sharing can lead to people seeing things they perhaps shouldn’t. Microsoft have very recently added new Cmdlets to the PowerShell library for SharePoint Online to allow us to control this as shown below:

Set-SPOTenant -ShowAllUsersClaim $False
Set-SPOTenant -ShowEveryoneClaim $False
Set-SPOTenant -ShowEveryoneExceptExternalUsersClaim $False

These settings when configured as False using these Cmdlets remove certain groups from the people pickers in SharePoint Online when we invoke a sharing request.

The first setting, ShowAllUsersClaim controls whether users have the ability to share something with everyone within your Azure Active Directory tenant. This object includes both users who are internal to your organisation and users who have previously accepted sharing invitations. When this is disabled, users will not be able to see the All Users objects listed in the people picker so will not be able to broadly share anything to the entire organisation

The second setting, ShowEveryoneClaim controls whether to show or hide the Everyone object. The everyone object includes both internal users and external users but it includes external users of the authenticated and unauthenticated varieties so this object is the most damaging in terms of scope. You could argue this is less of an issue if you have already disabled the ability to share with unauthenticated users using the Cmdlets in the previous section but if that is the case, why confuse your end-users with the two different entities.

The final setting option is ShowEveryoneExceptExternalUsersClaim. This last option controls the Everyone Except External Users object. This object controls whether or not you are able to share something to your entire organisation but not to individuals outside it whether they are authenticated or not.

My personal feeling on this is that All Users and Everyone should be hidden for most people and that you could leave the final option for Everyone Except External Users enabled if you want to give your users the ability to broadly share within the organisation.

Limiting OneDrive for Business Sync Capabilities

UPDATE: In a partner post which I released the day after this was published, I have covered how we can manage and limit the OneDrive for Business client and it’s offline synchronisation capabilities to managed devices. You can see that post at http://richardjgreen.net/managing-offline-sync-onedrive-for-business/.

Office 365 Limited Administration Roles

In the past when managing Office 365 permissions, we had several options for granting ‘super user’ rights to users however these stopped somewhat short of allowing us to be selective over what parts of our Office 365 deployment an administration could have control. You could either make somebody a Global Admin which essentially gave them the keys to the kingdom or you could assign them one of the reduced adminsitration roles such as Password Admin or User Management Admin.

Fortunately, Microsoft listened to the vast feedback they must have recieved about this and in Office 365 we now have three new limited administration roles for Exchange Online Admin, SharePoint Online Admin and Skype for Business Admin as well as the existing roles including Global Admin. These new roles allow us to assign users permissions more appropriately scoped to their role in the organisation. If an admin is only responsible for SharePoint then no longer do we need to him them unnecessary rights to amnage Exchange so that they can perform Site Collection administration in SharePoint for example.

To take advantage of these new roles, you need to ensure that you are using the Office 365 Admin site to manage the permissions and not the Azure Active Directory settings in the Azure Management Portal (you knew that you could manage users there too right).

Azure Active Directory Organisational Roles

The image above shows the roles that are available if you are managing a user through the Azure Management Portal and as you can see, the same old options limiting you to using a Global Admin role are present. If you use the Office 365 Admin site however as shown below, you can see the new roles.

Office 365 User Roles

When changing permissions of your users, be careful that you don’t take away permissions from users that they actually need. As always, an element of caution should be applied.

If you want to see what permissions map to each role and how they differ, you can view the full table at https://support.office.com/en-us/article/Assigning-admin-roles-d58b8089-cbfd-41ec-b64c-9cfcbef495ac#__choose_an_admin

 

 

Microsoft Announce E5 Plan for Office 365

Currently in Office 365 when selecting Enterprise plans, we have the choice of four ranging from E1 up to E4.

At the Worldwide Partner Conference this week, a new SKU was announced called E5 which will be replacing the current E4 SKU. This new E5 SKU takes everything that was offered in E4 (namely E3 plus Enterprise Voice for Skype for Business) and adds even more features to help you adopt Office 365. Although this is not an available SKU right now, it looks set for the features to include the new Skype for Business services that are currently being trialled along with Power BI for Office 365 and potentially more stuff that we just don’t know about right now. Skype for Business currently has three new services in trial although these are limited to customers in the US at the moment.

The Cloud PBX feature will allow you to use Skype for Business Online without the need for a hybrid deployment with a Skype for Business Mediation Server hosted on-premises connected to SIP Trunks or ISDN circuits for

PSTN Conferencing allows you to host normal Lync meetings with the added capability of allowing parties to join the call from a telephone using Dial-In Conferencing. This can already be achieved using either a hybrid solution where PSTN callers join the call via a mediation server hosted on-premise or using a cloud based service such as those from InterCall or BT but the Skype for Business native offering brings it all under one roof with a single vendor to manage your billing and support.

The Meeting Broadcast feature allows you to broadcast your Skype for Business meetings online in instances where you need to have thousands of attendees joining such as a company-wide update meeting or a webinar. Although I confess to not having looked into this in-depth, there is no doubt this is being powered by Azure Media Services behind the scenes.

There are going to be questions that need to be answered for all of these new services such as how the billing model works, what countries it will be available in and will there be limited features in others. There is also the question (for existing Lync on-premise customers) or how the Cloud PBX solution will work with the likes of PSTN devices such as fax machines and whether or not ethernet based Lync clients (Tanjay devices) will work with the new Skype for Business but the promise of being able to have a fully cloud based PBX solution all under one umbrella of Skype for Business is very appealing.

Yammer Enterprise for Office 365

If you have an Office 365 subscription on any plan Small Business Essentials or above, you will be entitled to Yammer Enterprise. Yammer, if you are unaware is an enterprise social networking product that Microsoft acquired a while back and is billed to replace the social features in SharePoint Online over time. Enterprise social networking I think is like marmite and some companies promote the idea whilst others shy away from it which I think has held back adoption and therefore, Yammer isn’t as widely used as you would think, especially for a free service as part of your existing Office 365 license.

Regardless of this, in this post, I will walk you through the very simply steps to activate your Yammer Enterprise network for your Office 365 Tenant and explain some of the next steps you can take to make Yammer more integrated into your business functions and make it more functional for end-users.

Activate Your Yammer Enterprise Network

Activating the Yammer Enterprise Network is actually very simple. First, login to your Office 365 Admin Center as a Global Admin.

Office 365 Dashboard Activate Yammer

From the Dashboard presented when you login, you will have an option for Activate Yammer Enterprise under the Manage Your Organisation heading. Once you have selected this, you will be taken to the domain selection page.

Yammer Enterprise Domain Selection

On this page, you must select which of your verified Office 365 domains you want to activate Yammer for.

Yammer is designed primarily for single domain use so if you work at an organisation which has multiple domain names such as regional domains for each country or territory that you operate in then you will need to activate your Yammer Enterprise network for one domain initially. Once you have your network setup with a single domain, you can follow the instructions on the TechNet article Combine Multiple Yammer Networks (https://technet.microsoft.com/en-us/library/dn804812(v=office.15).aspx) to contact Yammer Technical Support to add the secondary domains.

Once you have selected your domain and you select the Activate Yammer Enterprise button, after a few minutes your new Yammer network will be created.

By design, Office 365 Global Admins will automatically be provisioned as Network Admins in Yammer to administer your network however I found this didn’t work as it should and I had to follow a fix I found on the Office 365 Community by adding a new Global Admin afer the network creation which did get added to Yammer and then I logged in as that user and re-added my other Global Admins manually.

Syncing Domain Users to Yammer with DSync

Whilst Yammer Enterprise is made available via your Office 365 Tenant and allows your users to use their Office 365 credentials for logging in to Yammer Enterprise (be it as a cloud user, an on-premise AD user via DirSync or AADSync or whether you have ADFS setup and configured), the user on-boarding and off-boarding processes for Yammer are distinct. What this means for your end-users is that whilst they can visit yammer.com and try and login using their Office 365 credentials, they actually need to be registered in your network first.

Microsoft provides a tool called Yammer Directory Sync or DSync which functions in a similar fashion to the DirSync or AADSync tools for Azure Active Directory. The DSync tool doesn’t sync any passwords because those are provided via Office 365 and Azure Active Directory however DSync will sync the Name, Job Title, Office, Telephone and Mobile fields of an AD object to Yammer and will provision an account for the user. Setting up Yammer DSync is outside of the scope of this post but you can find out more from the TechNet article Install Yammer Directory Sync (https://technet.microsoft.com/en-gb/library/dn799032).

Yammer Directory Sync will automatically create Yammer users in your network as new AD users are created and it will also remove users when they are deleted from AD covering off the provision and deprovision processes. As you would expect, the tool updates user attributes as they are changed in AD.

If you don’t setup Yammer Directory Sync then each of your users will need to manually register for Yammer the first time they visit the site and accounts will not be automatically deprovisioned when you remove an AD user account.

Replacing the SharePoint Newsfeed with Yammer

SharePoint Online as with all versions of SharePoint 2010 and 2013 provides the Newsfeed functionality which is designed to be your timeline of information for your companies collaboration world. The Newsfeed in SharePoint is part of a users’ My Site area however Yammer being an enterprise social network provides a better capability for newsfeed and maintaining two systems for one function is redundant. Luckily, there is an option we can change that will replace the native SharePoint Newsfeed with the Yammer service.

As a Global Admin, login to the Office 365 Admin Center and browse to your SharePoint Admin Center. From the SharePoint Admin Center, among the options, you will find a setting titled Enterprise Social Collaboration. Under this heading, change the setting from Use SharePoint Newsfeed (Default) to Use Yammer.com Service. As per the description for this setting, it can take up to 30 minutes for the setting to propagate all of the Office 365 servers so for a short period of time, some users may still be directed to their Newsfeed after this is changed.

Embedding Yammer Feeds into SharePoint

SharePoint is where your company stores its documents and data so it makes sense to have related comments and social interaction from staff in the same place. On the Yammer site, you can find out how to use Yammer Embed to incorporate Yammer Feeds and Pages into your SharePoint sites or even any HTML web site your company may have. You can find out more about Yammer Embed at https://developer.yammer.com/v1.0/docs/embed.

It’s worth noting here that there is currently, a Yammer Web App for SharePoint however this is being discontinued later this year therefore there is no point building a system using the Web App now as you will have to re-create it before not too long and it makes better sense to develop using the long-term solution now.

I hope this post sheds a bit more light on what Yammer is, how to get it and how to start using it.

Administering Sway in the Office 365 Admin Center

With the release of Sway as I discussed in my earlier post today, Sway for Office 365 and What It Means for PowerPoint there is another application in Office 365 than now can be managed by tenant administrators.

For some organisations, they may want to stop users from using Sway or they may be happy for people to use Sway but don’t want anything authored in it to be shared outside of their organisation. To this end, we have some new administrative controls in the Office 365 Admin Center for managing Sway.

After logging in to the Office 365 Admin Center as a Global Administrator, expand the Service Settings node in the menu and then select the Sway option.

Office 365 Sway Admin

As you can see in the screenshot above, we don’t have many options right now but remember that Sway is a preview product and with more features destined for the product there I suspect will be more options for management over time also.

As of today, we have two management options. Firstly, we can completely disable Sway if we don’t want users to be able to access it. Changing this setting does not remove the Sway icon from the Office 365 App Launcher.

As you can see from the first screenshot below, when the Let people in your organisation use Sway option is disabled, users can still log in to Sway however if they try to access the My Sways menu or do anything, they will be shown the accounts are not yet supported error message.

The second option we have is to disable sharing outside of the organisation. When this option is selected, users will still be able to login to Sway and they will still be able to select the share with public option on their Sways however trying to access a Sway link as a user outside of the organisation, you will be shown an unauthorised access page as shown in the second image below.

Office 365 Sway Disabled  Office 365 Sway Unauthorised

Sway for Office 365 and What It Means for PowerPoint

This week, the newest product for Office 365, Sway has been made public and is rolling its way out to Office 365 Tenants around the world.

I first noticed Sway had appeared in my tenant last night although it could have been earlier. Users can access Sway from their Office 365 Apps with the green Sway icon as shown below and they can login using their normal Office 365 credentials.

Office 365 Apps with Sway

In addition to the web interface for Sway, there are currently Sway apps available for iOS and Android and in typical Microsoft fashion of late, not for Windows Phone, something that continues to frustrate me that Microsoft leave their own platform to last to get access to apps and features.

So What is Sway?

Well that is a good question and in reality, it is a bit of whatever you really want it to be. I think of Sway as a modern cross-over between OneNote and PowerPoint, allowing you to record and collate information from various sources such as images and text, social links to Twitter, Facebook or YouTube like you can use OneNote for casual note taking and collation of text and images however with Sway, it presents it in a beautiful reflowing format that makes your content look great across a multitude of devices and form factors including the ability to automatically reflow the content for the screen resolution and orientation for you. This is where I liken it to PowerPoint in the sense that it is designed to present and portray your content in a way that people will be drawn to it and want to read it or at least that is the intention with slide decks right?

Sway has been designed for a mobile and cloud first world such that you can not only view but also author a Sway using just your web browser making it ubiquitous across platforms. The mobile apps are there in order to enhance the experience and make it easier to author Sways from portable devices.

I haven’t really played with it myself much right now but I’ve watched a few videos on it over on Channel 9 and it certainly does produce nice aesthetically pleasing output but I think that the usual rule of garbage in, garbage out will still apply. Yes, if you provide Sway with garbage input it will make that garbage look nice but it will still be garbage. I think that Sways will be best suited to those who can make the most of a host of information be it text, images or multimedia from a range of sources because Sways consisting of just plain text won’t be very engaging.

The PowerPoint Replacement

What interests me with Sway is how it could potentially be used? We’ve all seen far too many dull PowerPoint decks that make us want to either play Candy Crush on our phones instead or simply roll over and sleep so I would be interested to see how in the real world, with real information to convey, Sway could be used as a replacement to PowerPoint to deliver an engaging presentation.

I tested this theory earlier today using my Logitech R400 slide clicker that I bought for driving PowerPoint decks hands-off and to my surprise, it works really well with Sway, advancing through the Sway as you would expect it to so Microsoft have done a great job of linking Sway controls to the mouse click events that the clickers commonly use for advancing and rewinding PowerPoint slides. If we could just bring some of the multi-authoring capabilities from Office to Sway so that multiple people in an organisation could work on a Sway together that for me would seal the deal.

What I would like to see though, to make this truly possible for a mass market is two things. Firstly, I think that there needs to be some kind of offline mode for Sway so that I can download a Sway that I have created into a single file package or a HTML5 local cache so that I can launch from my laptop without connectivity because we all know that when delivering customer or board room presentations, you can’t always be sure that there will be internet connectivity to access Sway online.

Secondly, there needs to be some kind of presentation mode in Sway.

Right now, we have an option in the toolbar at the top for Preview which puts the Sway into a chromeless view port and I can hit F11 in Internet Explorer to make that full screen which gives the impression of a presentation however there are a few problems I see with Preview mode like this today. For one, the Sway logo is shown in the upper left corner when you are at the start of the Sway which I don’t want to see on my slide decks along with the fact that the forward and back controls are permanently visible in the lower right corner. The biggest problem though is that most users won’t know that F11 is the full-screen view shortcut for Internet Explorer and Project Spartan or Microsoft Edge as we should call it doesn’t even have a proper full-screen mode right now and I definitely don’t want to see a presentation within the Internet Explorer or Microsoft Edge window.

I genuinely think that with the right introduction of multi-authoring tools and a fully fledged presentation mode, Sway could be the death of PowerPoint as we know it. I think Sway has a lot of potential and I really look forward to seeing what Microsoft do with it once it’s an official product and out of preview.