Or be proactive and create a report about existing apps and permissions and take appropriate action to make sure that everyone stays working. The new restriction only applies to new grants. It is not retrospective.

Purchased the book, never took time to read it (or some pages for my current need), will definitely take that time 😀

Rats. Do you happen to know if any if the out of the box fields support hyperlinking by default?

Nope. That’s not possible.

Well, you would know how to resolve a tenant identifier if you read the Automating Microsoft 365 with PowerShell book…

Oh I didn’t know you could resolve a tenant ID ! Thanks again for the hint !

The tenant name resolves to OrgidApps.onmicrosoft.com. I believe this is a Microsoft site because the Office 365 apps you reference are all Microsoft apps. Office 365 SharePoint Online is literally SharePoint Online, etc.

I found many apps in my sign-in logs, the majority of them has an “Owner Tenant ID” of “f8cdef31-a31e-4b4a-93e4-5f571e91255a” apparently meaning it’s a Microsoft first-party app, so as you wrote I assume they’ll take care of Microsoft apps (despite not having updated the documentation accordingly).

I also found 4 apps with following Name / App ID :
Office 365 / 72782ba9-4490-4f03-8d82-562370ea3566
Office 365 / f1f80920-bac6-4e06-bfaa-4e6d175eef75
Office 365 SharePoint Online / 00000003-0000-0ff1-ce00-000000000000
Office 365 Exchange Online / 00000002-0000-0ff1-ce00-000000000000

Can’t seem to find anything about them, besides that some were used in phishing campaings… Can’t find anything neither about their Owner Tenant ID which is “475130ab-62b5-4241-a9d3-47e37c9bc215”. Also, can’t find neither of “Office365” apps in my Enterprise Apps, I’ve tried all the filters… Should I be worried ?

I found that V3.8.0 of the Exchange Online management module works with V5.1 PowerShell runbooks. There might be a clash with runtime components similar to that experienced with .NET by the Microsoft Graph PowerShell SDK . I have pinged the EXO PS team to ask what’s going on.

Thanks. I admit that I’m a bit confused now or misunderstand something. To my understanding the access to Exchange Online via ActiveSync was blocked while basic authentication was depreciated 2/3 years ago.

I was asking about the EWS/f8d98a96-0999-43f5-8af3-69971c7bb423 because I’ve found a lots of SOAP actions for this app in the EWS Usage Report for Exchange Online – and – for my understanding – it correlates with the fact that many users in my organizations are using iOS native app (or is it something else?)

Thank you for confirming, I just created a case with them

Exchange ActiveSync is an old and stable protocol. It is documented online. You can read all about it there. ActiveSync hasn’t changed, so the EWS deprecation won’t affect it.

Thanks for the quick response! I’m also hoping that Microsoft is working closely with Apple to make sure the native iOS Mail app can access Exchange email and calendar smoothly. If you have any updates or insights on this, I’d really appreciate it if you could share.

I’ll flag this to Microsoft. I see the same issues. Please report it to support for your tenant. That will make sure that the issue is recorded officially.

I downgraded, and the strange thing is that any set-commands (Set-Mailbox, Set-DistributionGroupMember) are causing an error, while get-commands (Get-Mailbox, Get-DistributionGroup) are working correctly.

I believe that Microsoft is working with Apple to make sure that any use they have for EWS is amended. The Apple iOS native mail app doesn’t use EWS. It uses Exchange ActiveSync.

Search for https://www.google.com/search?q=install+earlier+version+of+powershell+module+azure+automation+account&rlz=1CDGOYI_enIE1105IE1105&oq=install+earlier+version+of+powershell+module+azure+auto&gs_lcrp=EgZjaHJvbWUqBwgDECEYoAEyBggAEEUYOTIHCAEQIRigATIHCAIQIRigATIHCAMQIRigATIHCAQQIRigATIHCAUQIRigAdIBCTQ5OTQ3ajBqN6gCGbACAeIDBBgBIF_xBYMjn09b3VtB&hl=en-GB&sourceid=chrome-mobile&ie=UTF-8 and follow the instructions to install an earlier version.

Thank you for the quick reply , Run book version 5.1, Exchange 3.8.0, Is there a way i can downgrade in the runbook to that module

Reading MC1089315 (revised version), it seems like they have broadened the description so that ALL sharing links created prior to enabling B2B collaboration for SharePoint Online are invalidated. That’s the way I read the text.

Microsoft is truly an interesting and bewildering organization sometime…

What version of PowerShell and the EXO module are you using?

I did a quick test using PowerShell 5.1 runbook and EXO V3.7.2 and everything worked.

It appears it only works for mail-enabled security groups or possibly distribution groups.

Thank you for this, I have followed the steps and I am able to connect to exchange online fine with Managed Identity and even able to get the Distribution group but when I try to update my Distribution group membership, I get the below error

System.Management.Automation.CommandNotFoundException: The term ‘Add-DistributionGroupMember’ is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

Can you please let me know what am I missing

I think some weighting is given to newer material. At least, I sure hope so!

Good luck fighting against Meta, Google, and Microsoft… Putting good content behind a paid-for firewall seems like the only way forward to me.

Is there any initiative against this (IMO bad) trend? If not, we should start one.

Maybe. I simply haven’t tried.

Based on MS Learn, even individual files should get updated if they change: “Connected files from OneDrive and SharePoint, and unstructured knowledge articles are kept fresh using a scheduled synchronization job. This job runs automatically in the background, refreshing the contents of the files and reindexing the changes to provide accurate results for queries.” https://learn.microsoft.com/en-us/microsoft-copilot-studio/knowledge-unstructured-data

The responseheadersvariable parameter for the Invoke-MgGraphRequest cmdlet populates the variable.

In the last code block does the first line need to be assigned to the $Response variable?

If not, I cannot see where line 2 gets the location:
“[string]$ResponseLocationURI = $Response.Location”

Generative AI cannot create. It can only repeat. And what it repeats can be wrong – very wrong – if the text it chooses is wrong. Generative AI can put some lipstick on the pig by making sure that grammar and spelling are correct, but it doesn’t have the domain expertise or awareness of how things interact inside a complex ecosystem like Microsoft 365 to realize when problems exist in text that it finds. And that’s how generative AI can deliver poor, misleading, inaccurate, or just plain wrong information in its responses. Like any data processing project, crap in equals crap out. If AI has great input information (like the reference documents you can give to many chat apps), then it can do a good job, just like Copilot does when it processes Outlook message threads or Teams meeting transcripts.

I think the issue with Google finding office365itpros.com is that each domain has a rating that conveys how authoritative it is. That rating takes years to build, and the lower the rating, the lower articles appear in Google’s list. For example, Microsoft’s domain (naturally) has a high rating, so its articles usually appear first or second in a list.

Btw, your site is hard to find on Google too. I have multiple occasions when i knew i read about some news on your site at home and then at work trying to find that article, i would never get your site in results and would have to just go to your site and scroll through recent articles. Maybe because the name is in general terms. I never remember it exactly, so i put office 365 pro or something and get a lot of sites, but not yours 🙂

Nope. But I don’t write for Microsoft to pay me as part of the MVP program. I write because I like to, and because the activity supports the development of the Office 365 for IT Pros eBook. It is helpful to write an article about a topic and then take the topic to the book. The text in the book might be longer (more detailed) or shorter than an online version, and Office 365 for IT Pros is updated monthly unlike web articles, but writing the initial article helps to frame the topic and clarify what’s important.

MVPs are not paid for their contribution to the program, nor should they be. However, MVPs are assessed on their contribution to the technical community, and if publishing not-for-payment articles on websites becomes less attractive because of fallin page views, then there will probably be less of this activity and less knowledge will be shared. That would be sad.

I agree that the issues caused by website harvesting by AI LLMs won’t cause me too much bother simply because I’m at the back end of my career. But I do care about the future of the technical community and how the actions of some very large companies deprive some websites of the chance to grow and prosper as they share invaluable technical information.

Have you tested this feature yourself? I don’t have a hybrid environment to test against.

Thank you both! I was on the right track but somehow managed to fat-finger it.

Connect-SPOService -Url https://-admin.sharepoint.com
Get-SPOTenant | Select *B2B*

Hi Joseph,

You can check with the “Get” version of the Cmdlet that allows you do enable/disable the feature.

PS> Get-SPOTenant | Select-Object EnableAzureADB2BIntegration
EnableAzureADB2BIntegration
—————————
False

Would anybody happen to know how to check if a tenant has enabled SPO/OD B2B OTP integration? I honestly haven’t the slightest idea whether my two tenants have this enabled or not, and while I’ve found the cmdlet to enable/disable it, can’t seem to figure out how to determine whether or not it’s enabled in the first place.

Sadly first one is not an option (many guests with hotmail or Gmail email adresses, also nominative OneDrive external file sharing could/should be less restricted than guest access in my opinion), neither is last one (currently my org does not have the required license for all its users + we’re not at that stage of deployment (currently deploying Teams teams, yet we could discuss which one’s the prerequisite for the other one 😅)).
But second one is an interesting path, I’ll check that, tank you very much for your post and answers ! 🙂

Entra ID integration with SharePoint Online and OneDrive for Busines operates OTP for sharees that don’t have an existing guest account “Authentication happens via one-time passcode when they don’t already have a work or school account or a Microsoft account.” : https://learn.microsoft.com/en-us/sharepoint/sharepoint-azureb2b-integration. “Azure B2B Invitation Manager one-time passcode feature allows users who don’t have existing Work or School accounts or Microsoft Accounts to not have to create accounts to authenticate, but can instead use the one time passcode to verify their identity.”

If a file is shared with a guest account that’s able to authenticate, then OTP isn’t used and the links aren’t affected. If you’re using guest accounts to share files etc. with other Microsoft 365 tenant accounts, they aren’t affected.

Yes, that’w what I expect. The signed-in account needs a role and permission to update settings.

So for these steps, we still need to assign the application one of the roles above and assign this API permission to the application?

few more details, hope these assumptions are correct what we found, can you please confirm?

in case organizations use Azure B2B invitation manager (tenant SharePoint admin sharing settings – existing guests only) then these links are not impacted

only links which are created by SharePoint / ONB via old b2b invitation manger is impacted (tenant sharing settings – New and Existing guests)..

The easy way to control guests is:

1. Implement a B2B Collaboration policy to limit the domains guests can come from: https://office365itpros.com/2021/05/10/entra-id-b2b-collaboration-policy/
2. Block guest access to specific teams/groups https://office365itpros.com/2018/11/04/block-guest-access-to-teams/
3. Use sensitivity labels to block guest access to confidential files shared in Teams.

I guess that’s the tenant wide “Guest invite settings”, and that would be problematic in the scenario I described (forced to allow anyone to invite guests, including in Teams, to allow external (but not anonymous) sharing in OneDrive), but it’s not very clear…

But because I’m a nice guy, I changed the opening H2 to emphasize the point.

Well, I might be taking a certain liberty with the title to drive awareness of an important change that is being implemented in 3 weeks time, but I’ll take that on the chin.

The text clearly says that the change only applies to tenants that have implemented the B2B integration with SPO. I just wonder how many tenants use “pure” OTP…

The change is that once a tenant optionally enables SharePoint/OneDrive B2B OTP integration, all previous SharePoint OTP links will immediately stop working.

If a tenant does not enable the integration, then nothing changes, and the old SharePoint OTP method will still work.

I don’t think so… It’s easy to test, but there’s something in the back of my mind that says that SharePoint and OneDrive use a different process to the one where Teams invites users.

This makes me think that Microsoft will someday force all tenants to move to Entra ID B2B for Sharepoint and OneDrive sharing… Thus forcing tenants to allow users to invite Entra ID guests whenever they want to share some OneDrive file ?
That’s actually annoying for my org. We disabled anonymous OneDrive sharing (thus making the email OTP mandatory), and disabled the ability of any user to create guests users (we have a custom process in Coreview for that, that user have to request separately, when they want to invite some external user to a specific team or Sharepoint site). I guess if we want to move Sharepoint Online external access to Entra ID B2B we’ll have to allow all users to invite guests (at least for OneDrive sharing) ? Then they’ll be able to invite anybody in their teams, without using our custom process, right ?

Loop components, shared files, that kind of thing…

Gotta get test names somehow… and I set up new ones regularly after I get tired of the spam sent to the test accounts…

A full article explaining what happened…

How to List Hidden Group Memberships with the Graph

https://office365itpros.com/2025/05/29/hidden-group-memberships/

I’m not sure that the photo ever synchronized from on-premises AD to Entra ID. There’s been so many moving parts with user photo management over the past few years that it would surprise me if seamless synchronization works. You can always stop users uploading photos and do background photo management using PowerShell scripts to upload/update photos for users with on-premises accounts. That should be a pretty easy script to write.

Oh well, at least the Graph request works.

I don’t believe so. I think that string (and its translated values) are buried deep in code.

May I know the method to restrict user self-upload, in the meanwhile, allow DirSync account to replicate the changes from onPrem to EntraID?

A couple of points to remember. First, documentation is not always correct. Microsoft documentation has improved greatly over the last few years, but it still contains errors. Second, Copilot is under such active development that it’s hard for documentation to keep up with change. Third, the recent layoffs removed some pretty good writers from Microsoft’s documentation team. Your account team can ask, but whether they’ll get a better answer depends on who they can talk to. Last March, talking to some of the Copilot development team in Redmond, I was told that they don’t bother documenting how some parts of the system work because it’s changing so often…

Intresting. Looks like Microsoft documentation is out dated, I will reach out to my Microsoft account team. Thanks Tony for the clarification,

Well, I see what you mean from the product description. Other engineers on the Copilot team told me that the license covers the semantic index and that sort of intelligent indexing. I guess it doesn’t really matter all that much.

Regarding intelligent search SKU, MS article states its related to dataverse and not related to M365 search. Could you please double check this? This would be very helpful.

https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-platform-service-description/microsoft-365-copilot

https://feedbackportal.microsoft.com/feedback/search/?q=teams+copy+timestamp

Interesting… I was using Get-UnifiedGroup to get the membership without any issue. The Graph Get-MgGroupMember worked too, but that could be because of some other permission (like Directory.Read.All).