Posted on

OneDrive ADMX files (download)

When you want to migrate an older environment to Office 365 and OneDrive, you might miss the OneDrive GPO settings. Unfortunately Microsoft hasn’t release the download of the ADMX files. You will need to grab them manually from a recent Windows 10 machine, and import them in the right location.

Since I like to simplify things, I thought it might be convenient to create a prepared ADMX ZIP file with all necessary files, ready for extraction. So here is a link to download OneDrive ADMX files. Just simply extract the proper folders to the following location:

Local Domain Controller store:
C:\Windows\PolicyDefinitions\

Central Active Directory store:
\\<your domain>\sysvol\<your domain>\Policies\PolicyDefinitions\

Download OneDrive ADMX Files
Posted on

Microsoft adds IPv6 support for Azure VNets (Preview)

Today I noticed a new checkbox in the Azure Portal. Microsoft has released IPv6 in the Public preview for Azure VNets. Virtual machines will be equipped with a dual-stack IP connectivity. Meaning both will be available. With the ending of IPv4 addresses it makes IPv6 mandatory for everybody.

The new checkbox in Azure

From the Azure portal you can now add IPv6 address to the address scope on the VNet level.

The following diagram shows how IPv6 works as a dual-stack next to IPv4

Continue reading “Microsoft adds IPv6 support for Azure VNets (Preview)”
Posted on

Lock down Microsoft Team creation (Manual)

By default everyone may create a new team in Microsoft Teams. As an organisation admin you might want to control this, or release it a some point. With this manual you should be able to lock down team creation to users that are member of a Azure AD Security group.

STEP 1: First we will need to install the Preview version of the Azure Active Directory PowerShell module for Graph. Open a PowerShell window with Adminstrator privileges and run the following 2 commands:

Uninstall-Module AzureAD
Install-Module AzureADPreview

STEP 2: Now we will need to connect to Azure-AD to perform the necessary actions. Sign in with an admin account when prompted.

#Connect to AAD
$AzureAdCred = Get-Credential 
Connect-AzureAD -Credential $AzureAdCred

STEP 3: In Azure AD using the Azure portal (https://portal.azure.com), create a new security group.

STEP 4: Enter the name of your security group on the top line, and run the following script. 

$GroupName = "Your Security Group Name"
$AllowGroupCreation = "False"

$settingsObjectID = (Get-AzureADDirectorySetting | Where-object -Property Displayname -Value "Group.Unified" -EQ).id
 if(!$settingsObjectID)
 {
       $template = Get-AzureADDirectorySettingTemplate | Where-object {$_.displayname -eq "group.unified"}
     $settingsCopy = $template.CreateDirectorySetting()
     New-AzureADDirectorySetting -DirectorySetting $settingsCopy
     $settingsObjectID = (Get-AzureADDirectorySetting | Where-object -Property Displayname -Value "Group.Unified" -EQ).id
 }
 $settingsCopy = Get-AzureADDirectorySetting -Id $settingsObjectID
 $settingsCopy["EnableGroupCreation"] = $AllowGroupCreation
 if($GroupName)
 {
     $settingsCopy["GroupCreationAllowedGroupId"] = (Get-AzureADGroup -SearchString $GroupName).objectid
 }
  else {
 $settingsCopy["GroupCreationAllowedGroupId"] = $GroupName
 }
 Set-AzureADDirectorySetting -Id $settingsObjectID -DirectorySetting $settingsCopy
 (Get-AzureADDirectorySetting -Id $settingsObjectID).Values

The result of the script should give you the updated settings. On the last line you should see EnableGroupCreation. If you want to reverse this setting. Just simply change the following line to True and run the entire script:

$AllowGroupCreation = “True”

If you want another security group, rerun the script with the new group name.