Month: December 2024
The Confusing Renaming of Microsoft 365 Copilot
Microsoft 365 Copilot Rename Means Exactly What?
By now, I’m sure that people understand that Microsoft has two chat apps available for Microsoft 365 users:
- Microsoft Copilot, which is limited to making queries against the Microsoft LLMs. The app is available without a license to anyone who signs into their Entra ID account before they can use Microsoft Copilot, which is why it’s sometimes referred to as Microsoft Copilot (for users with Entra accounts). This app started as Bing Chat Enterprise before the Copilot branding team applied their magic. To be fair, the addition of enterprise data protection to Microsoft Copilot in September 2024 improved the app greatly.
- Microsoft 365 Copilot, which can include Graph content (data stored in SharePoint Online, OneDrive for Business, Teams, and Exchange Online) in its queries against the Microsoft LLMs (the Graph content “grounds” the queries). This app is also called BizChat, and I use that name for the remainder of this article. User accounts must hold a $360/year Microsoft 365 Copilot license before they can use BizChat.
The naming used for these apps and the Microsoft 365 Copilot suite (a Copilot for every app, like Copilot in Word, Copilot in Teams, Copilot in Outlook, etc.) has evolved since the original launch in March 2023. In that time, probably far too many brain cells have been sacrificed to keep up with Microsoft’s marketing machinations as they seek to drive Copilot deep into the consciousness of Microsoft employees and customers alike.
The January 2025 Change
Message center notification MC958903 (16 December 2024) marks yet another turn in the naming game. In mid-January 2025, Microsoft will introduce changes “to simplify the user experience.”
- Microsoft Copilot becomes Microsoft 365 Copilot Chat. The app will be able to use Copilot agents for the first time. Agents that access web content are free, but using agents that access work data (Graph data) must be paid for on a pay-as-you-go (metered consumption) basis.
- The current Microsoft 365 app, which includes a Copilot icon to access Copilot in its navigation bar, becomes Microsoft 365 Copilot, complete with a new M365Copilot.com URL to “make it easier to discover.” Depending on their licensing status, the Copilot icon brings people to either Microsoft 365 Copilot Chat or BizChat. The app will receive a UI makeover to “support future AI-first experiences” like exposing Copilot Pages. The changes are detailed in MC958905 and include a new icon that I thoroughly dislike (see Figure 1).
All of this was discussed at the Ignite 2024 conference in Chicago last month. I paid little attention at the time because I ignored most of the marketing fluff from the conference, preferring to wait to see the details emerge. If you’re interested, the keynote is still online, complete with a very brief mention of a rename (Figure 2).
The Confusion Between Product and App
I dislike renaming Microsoft Copilot to be Microsoft 365 Copilot Chat because it complicates what should be a simple differentiation between users who have Microsoft 365 Copilot licenses and those who do not. Once you apply the Microsoft 365 brand to an app, a certain implication exists that the app has something to do with Microsoft 365 and enjoys some access to Microsoft 365 content (which it doesn’t have).
I guess the chat app that can’t access Microsoft 365 content has some relationship with Microsoft 365 because it’s available through the Microsoft 365 Copilot app, but the connection is tenuous at best and difficult for people who don’t track the minutiae of changes within the service. It took me several readings of MC958903 before the details sunk in. I suspect that I am not alone.
I’m sure that Microsoft will point to its fabled telemetry to justify the decision. They always do. However, I think this is more of the “let’s brand everything with the <insert latest product du jour name here> name here” tactic seen in the past with Windows, Office, and .Net. The problem is that telemetry seldom highlights the potential for future confusion of the sort that’s likely when this change emerges.
Tiring Pace of Branding Changes
Everyone understands that Microsoft is making a big bet to be the leader in AI. Microsoft is spending a ton of money to build their leadership, including a reported $19 billion spend reported in their Q4 FY24 results. But the constant mantra of Copilot everywhere is starting to wear. It will be a relief when the tsunami subsides and we can all get back to productive work, with or without Copilot’s assistance.
Make sure that you’re not surprised about changes that appear inside Microsoft 365 applications by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers stay informed.
Blocking Microsoft 365 Copilot From Making Inferences in Teams Meetings
Copilot Inference and Evaluation Policy Blocks Copilot in Teams from Interpreting Participant Emotions During Meetings
One of the interesting things about using Microsoft 365 Copilot in Teams meetings (or rather Copilot in Teams, for it’s only one of the many Copilots licensed by Microsoft 365 Copilot) is that it attempts to evaluate user sentiment based on their contributions to meetings. Copilot does this by analyzing the words spoken by participants to “infer emotions, make evaluations, discuss personal traits, and use context to deduce answers.”
Evaluating how happy someone is during a meeting sounds a bit too much like big brother oversight to many, especially in countries where personal privacy is more highly prized than in others. In your organization is in this situation, tenant administrators can restrict “Copilot’s ability to make inferences or evaluations about people or groups when prompted to do so by users” by updating the Copilot inference and evaluation policy.
A Simple Graph Query
Microsoft explains how to update the policy in message center notification MC916990 (last updated 16 December 2024, Microsoft 365 roadmap item 411568). Deployment to tenants with Microsoft 365 Copilot licenses is now complete.
MC916990 describes how to use the Graph Explorer to update the policy. Much as I like the Graph Explorer, the description given isn’t very clear and lacks some essential detail, like how to format the JSON input payload (Figure 1) and the required permission.
The Copilot Admin Limited Mode Resource Type
Here’s some of that detail together with instructions about how to do the job with the Microsoft Graph PowerShell SDK. The first thing to know is that the Copilot inference and evaluation policy is represented in the Graph by the copilotAdminLimitedMode resource type. This is important to know, because we can then reference the documentation to discover that the CopilotSettings-LimitedMode.ReadWrite permission is needed to update the policy. This is a delegated permission, so it works in the context of the signed-in user, and only accounts with the Global administrator or Global reader roles can update policy settings.
The documentation for the Get and Update operations doesn’t include any Microsoft Graph PowerShell SDK cmdlets to get and update the policy, but we can use the HTTP URI to interact with the policy through the Invoke-MgGraphRequest cmdlet.
To begin, let’s sign into a Microsoft Graph PowerShell SDK interactive session and request the necessary permission.
Connect-MgGraph -Scopes CopilotSettings-LimitedMode.ReadWrite
If CopilotSettings-LimitedMode.ReadWrite is not in the static list of permissions held by the service principal for the Microsoft Graph Command Line Tools app, you’ll be prompted to grant consent (Figure 2):
Next, let’s fetch the current policy values by running Invoke-MgGraphRequest with a Get request to the URI for the policy. The values shown below are the defaults:
$Uri = "https://graph.microsoft.com/beta/copilot/admin/settings/limitedMode" $Data = Invoke-MgGraphRequest -Uri $Uri -Method GET $Data Name Value ---- ----- isEnabledForGroup False groupId @odata.context https://graph.microsoft.com/beta/$metadata#copilot/admin/settings/limitedMode/$entity
To update the policy and block Copilot evaluating sentiment for some users, you must create a group and populate its membership with the user accounts to block. Then find the object identifier for the group and copy it for reuse (Figure 3).
You can then use the group identifier to update the group settings. This code creates a hash table to hold the two settings to update. The first setting contains the group identifier (stored in a PowerShell variable). The second sets the value for the isEnabledForGroup setting to true for the members of the group. The effect is to instruct Teams to use limited mode for the members of the group when they are meeting participants. When the hash table is ready, run Invoke-MgGraphRequest again to patch the policy with the settings in the hash table.
$GroupId = 'f805d711-c4f4-4663-9993-b08b4be52cb5'
$Parameters = @{}
$Parameters.Add("groupId",$GroupId)
$Parameters.Add("isEnabledForGroup",$true)
Invoke-MgGraphRequest -Uri $Uri -Method Patch -Body ($Parameters | ConvertTo-Json)
The policy update can take up to a day before it is effective. When it is, Copilot will decline to answer questions about someone’s performance, emotions, or personal traits. Figure 4 shows two examples. The first is the same example as used in Microsoft’s announcement: ask if someone is happy based on their contributions to a meeting. The second asks who made the most positive contribution to the conversion.
In contrast, Figure 5 shows how Copilot responds to the same question asked by another meeting participant who isn’t restricted by policy.
Stop Big Brother Oversight
I’m not sure that many people ask questions about the feelings or emotions of other meeting participants. It seems like a kind of weird thing to do, and I can appreciate that some would find the prospect of AI measuring their emotions to be on the wrong side of big brother observation. With that thought in mind, this is a good update that organizations with Copilot should consider implementing.
Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.
Cloud Security Trends: Predictions and Strategies for Resilience
In 2025, cloud native security is set to undergo transformative progress. As Chief Information Security Officer at Aqua, I’ve seen how rapidly evolving threats and operational demands are driving organizations to redefine their approach to security. The focus is no longer just on adapting to challenges—it’s about deeply embedding security into every facet of development pipelines, runtime environments, and cloud ecosystems.
In 2025, cloud native security is set to undergo transformative progress. As Chief Information Security Officer at Aqua, I’ve seen how rapidly evolving threats and operational demands are driving organizations to redefine their approach to security. The focus is no longer just on adapting to challenges—it’s about deeply embedding security into every facet of development pipelines, runtime environments, and cloud ecosystems. Read More
Processing Microsoft 365 Retention Labels with the Microsoft Graph PowerShell SDK
A Simple Question About Managing Microsoft 365 Retention Labels with the Microsoft Graph
A reader asked if it is possible to have scripts apply retention labels to files and email using cmdlets from the Microsoft Graph PowerShell SDK. This is an example of a question that seems like it should be easy to answer but turns out not to be the case. Let’s plunge in and explain why.
Two Types of Retention Inside Microsoft 365
Microsoft 365 supports two forms of retention labels. The first type is MRM (Messaging Records Management) retention tags, the second is Microsoft 365 retention labels. Microsoft would very much like to get rid of retention tags, and have been saying so for years. However, retiring MRM retention tags is impracticable because Microsoft 365 retention labels don’t deliver some of the features available through retention tags, such as folder-specific processing and the move to archive action.
MRM retention tags are only available for email while Microsoft 365 retention labels cover both files and email. The complexity is invisible to users because Outlook clients combine tags and labels into a common set. Figure 1 shows a list of retention tags and labels as seen in the new Outlook for Windows. Why the list isn’t sorted alphabetically as it is in Outlook classic is beyond me. Hopefully, Microsoft will sort this annoying aspect out before they discontinue support for Outlook classic in 2029.
The Exchange Managed Folder Assistant also combines tags and labels into a common set when it applies retention settings to mailboxes.
The Programmatic Issue
Microsoft has sorted the problem of different retention labels in its clients and background processing, but dealing with the two types of labels is problematic for programmatic interfaces. MRM retention tags can be applied to emails through Exchange Web Services (EWS) but not through the Microsoft Graph APIs because they deal exclusively with files.
Microsoft wants to retire EWS in October 2026 and suggest that developers should migrate their code to the Graph APIs. However, gaps exist in Graph coverage that make such a movement currently impossible, and retention labels are one such gap that Microsoft must close before it can retire EWS.
The alternative is that Microsoft enhances Microsoft 365 retention labels to add features like support for moving items to archive mailboxes. I don’t see any prospect of this happening in the short term.
An Example Script
An example script is always a great way to demonstrate how to use a Graph API. The OneDrive for Business file report script contains several examples of SDK cmdlets being used to access retention labels. Access to retention label information requires the RecordsManagement.Read.All permission, which is only available in a delegated form. The lack of an application permission might seem odd, but Microsoft 365 applications only show users the set of retention labels made available to them through label publishing policies.
One of the first steps in the script is to run the Get-MgSecurityLabelRetentionLabel cmdlet to retrieve the set of Microsoft 365 retention labels (but not MRM tags) available to the signed-in user.
[array]$RetentionLabels = Get-MgSecurityLabelRetentionLabel
The script fetches details of every file in every folder in the OneDrive account. To check if a file has a retention label, the script runs the Get-MgDriveItemRetentionLabel cmdlet and passes the drive identifier and the file identifier. The drive identifier points to a library in a SharePoint Online site or a OneDrive for Business account. Each file in the library has a unique identifier. Together, a file can always be found.
This modified form of the script code fetches the identifier for the default library in the OneDrive account of the user signed into a Graph SDK interactive session and finds all the files in the root folder. It then checks the first item to see if the file has a retention label. No values are reported in the set of retention label properties output by the cmdlet, so we know that the file is not labeled.
$User = Get-MgUser -UserId (Get-MgContext).Account
$OneDrive = Get-MgUserDrive -UserId $User.Id | Where-Object {$_.Name -like "*OneDrive*"}
[array]$Data = Get-MgDriveItemChild -DriveId $OneDrive.Id -DriveItemId "root" -All
[array]$Files = $Data | Where-Object {$null -ne $_.file.mimetype}
Get-MgDriveItemRetentionLabel -DriveId $OneDrive.Id -DriveItemId $Files[0].Id
Id IsLabelAppliedExplicitly LabelAppliedDateTime Name
-- ------------------------ -------------------- ----
Taking the concept a little further, here’s how to report the set of labeled files in the root folder of the OneDrive account.
$LabeledFiles = [System.Collections.Generic.List[Object]]::new()
ForEach ($File in $Files) {
$FileInfo = Get-MgDriveItemRetentionLabel -DriveId $OneDrive.Id -DriveItemId $File.Id
If ($FileInfo.Name) {
$ReportLine = [PSCustomObject]@{
Label = $FileInfo.Name
File = $File.Name
}
$LabeledFiles.Add($ReportLine)
}
}
Applying and Removing Retention Labels
The script doesn’t apply retention labels to items. If it did, it would run the Update-MgDriveItemRetentionLabel cmdlet. The cmdlet takes a hash table containing the name of the retention label to apply as its input:
$RetentionLabel = @{}
$RetentionLabel.Add("Name","Approved")
$Status = Update-MgDriveItemRetentionLabel -DriveId $OneDrive.Id -DriveItemId $File.Id -BodyParameter $RetentionLabel
If ($Status.Name) { Write-Host "Retention label assigned"}To remove a retention label from a file, run the Remove-MgDriveItemRetentionLabel cmdlet:
Remove-MgDriveItemRetentionLabel -DriveId $OneDrive.Id -DriveItemId $File.Id
The Graph Covers SharePoint and OneDrive but not Exchange
What we’ve learned is that Microsoft Graph PowerShell SDK cmdlets are available to get, apply, and remove Microsoft 365 retention labels from items stored in SharePoint Online and OneDrive for Business sites. If you want to apply MRM retention tags to email, you’ll need to use EWS. That is, until Microsoft retires EWS in 2026…
Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.
Microsoft Proposes a Horrible Change for the Search-UnifiedAuditLog Cmdlet
Poorly Thought-Out Decision will Reduce the Effectiveness and Usefulness of the Search-UnifiedAuditLog Cmdlet
On December 12, Microsoft published message center notification MC955752 to inform tenant administrators of a fundamental and problematic change in the way the Search-UnifiedAuditLog cmdlet behaves. In a nutshell, Microsoft proposes to make high completeness searches the only type of supported audit log search. That would be fine if these searches worked and were capable of finishing in a reasonable time. The problem is that high completeness searches are unreliable and take too long to complete.
Microsoft says that high completeness searches focus on retrieving a complete set of audit results in response to administrator queries. By contrast, they characterize the current behavior of the Search-UnifiedAuditLog cmdlet as speedy but can return “a subset of results.” My experience is that the current default tends to return too many results, which is why you should always sort the output set to exclude duplicates.
Microsoft then goes on to say that, out of the goodness of their hearts, they’re changing the way the Search-UnifiedAuditLog cmdlet works so that it will always run high completeness searches starting in late January 2025. To be fair, Microsoft notes that “search queries may take longer to finish.” I guess that they cannot get away from the fact that high completeness searches take between ten and twenty times longer to complete than the current searches.
A Complete Mess
I dislike the proposed change because I believe that making all audit log searches “highly complete” will affect scripts running in production today in ways that Microsoft has not anticipated.
As far as I can tell, the developers think about audit log searches as simple activities to recover audit log data. Those working with tenants use audit log searches for many other purposes, from forensic investigations following potential attacks to extracting audit results on an ongoing basis for ingestion into an external SIEM. Some ISVs use the cmdlet to extract audit information for their customers to use as the basis for some reporting.
Another example is where Microsoft engineering uses the Search-UnifiedAuditLog cmdlet to find evidence of the Exchange Web Services App Impersonation RBAC role in use. The script provided by Exchange engineering quickly becomes unusable when every iteration to find audit records takes ten minutes to complete.
Many scripts call the Search-UnifiedAuditLog cmdlet to find evidence of specific user activity. The searches might return just one or two records, enough to prove that someone is active, or they might deliver a more comprehensive assessment of the actions taken by a user account during a day. Waiting for ten minutes for a high completeness search to complete makes it impracticable for these scripts to use Search-UnifiedAuditLog (or the Graph API).
The Unreliability of High Completeness Searches
An even bigger problem is the unreliability of high completeness searches. I pointed this problem out when Microsoft released the feature in preview in April 2024. Things don’t seem to have improved much since. As an example, I ran the script to find SharePoint file operations to identify the last accessed time for documents, which is information that the Graph API for SharePoint cannot return. The search u looks for specific operations over a set period and is typical of the normal usage in Microsoft 365 tenants:
Write-Host ("Searching for SharePoint file operations in the {0} site between {1} and {2}" -f $TargetSite, $StartDate, $EndDate)
[array]$Records = Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate -RecordType "SharePointFileOperation" -ResultSize 5000 -SessionCommand ReturnLargeSet -Formatted -ObjectIds $TargetSearchSite
If (!($Records)) {
Write-Host "No audit records found"
Break
}
# Remove any duplicates
$Records = $Records | Sort-Object Identity -Unique | Sort-Object {$_.CreationDate -as [DateTime]}
Write-Host ("{0} SharePoint Online file operations audit records found" -f $Records.Count)
Running against the site I use to store the source documents for articles, a normal search retrieved 3,879 records in 31.02 seconds. This time included the sort to remove duplicates. Running the same search with the high completeness flag set resulted in a series of failures. For example:
Measure-Command {[array]$Records = Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate -RecordType "SharePointFileOperation" -ResultSize 5000 -SessionCommand ReturnLargeSet -Formatted -ObjectIds $TargetSearchSite -HighCompleteness}
WARNING: Failed to process request via HighCompleteness flag, returning HttpRequestException. Exception: InternalServerError , Reason: Internal Server Error.
Days : 0
Hours : 0
Minutes : 8
Seconds : 11
Milliseconds : 42
Ticks : 4910423270
TotalDays : 0.0056833602662037
TotalHours : 0.136400646388889
TotalMinutes : 8.18403878333333
TotalSeconds : 491.042327
TotalMilliseconds : 491042.327
In fact, despite many attempts over several days, the search never completed. Failures happened after six, seven, or eight minutes, even during the weekend when the service experiences light demand. Using high completeness searches was a deeply unsatisfying experience that doesn’t cast a good light on Microsoft engineering or software testing.
The Microsoft Imperative to Constrain Resource Demand
Microsoft has history in messing around with the Search-UnifiedAuditLog cmdlet in ways that affect production scripts. In September 2023, they changed the way searches worked so that fewer results were returned by default. Microsoft didn’t make any announcement at the time and denied that any change had occurred even though the evidence was clear and obvious that the cmdlet now functioned in a dramatically different way.
It seems to me that Microsoft is a victim of the audit log’s success. When it was first introduced, the audit log ingested data from core workloads like Entra ID, Exchange Online, and SharePoint Online for a relatively small number of events. Eight years later, thousands of different events are ingested from multiple workloads, which increases the resources required to store and process audit events. Another extra demand for resources came when Microsoft had to up the retention period for Purview Audit standard customers from 90 to 180 days. Conserving resources is why the Audit search in the Purview portal (Figure 1) only performs asychronous searches and doesn’t use the Search-UnifiedAuditLog cmdlet.
Microsoft points to the AuditLog Query Graph API as a method for programmatic access to audit data. This is true, but setting up and running AuditLog Query searches takes substantially more effort than running Search-UnifiedAuditLog does, even using the Microsoft Graph PowerShell SDK cmdlets to interact with the API. It’s one thing for Microsoft to switch the Audit search solution in the Purview portal to use the Graph API; it’s quite another to ask customers to upgrade all their PowerShell scripts to replace Search-UnifiedAuditLog. Making this suggestion in the message center notification displays a callous lack of appreciation about how paying customers use Microsoft software.
A Problematic and Concerning Change
The lack of robustness in high completeness searches is nothing but problematic. If you can’t rely on searches completing, you can’t include search processing in scripts. Although running interactive synchronous searches obviously takes more resources, it’s how paying customers extract value from the audit log.
Changing audit searches to high completeness is bad. It might save Microsoft some computing resources, it will impact production processes by forcing Microsoft 365 tenants to use unreliable and fallible methods to access what is, after all, their audit data. Microsoft should leave well enough alone and fix high completeness to make it an optional, slow, but (when fixed) dependable alternative for audit log searches.
Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.
Teams Gets Resizable Windows and More Pop-Out Panes
Resizable Teams Windows Will Be a Big Change for Users
Microsoft has been overhauling elements of the Teams user interface since the introduction of the Teams 2.1 client. Examples include the new chat and channels interface and hiding unused channels. Despite having had the chance to discuss the logic driving the decision to go with the new chat and channels interface with its designers, I remain unconvinced. Hiding unused (inactive) channels has also proved disruptive for some. Both examples prove the difficulty of introducing change to a client that’s literally used by hundreds of millions of people.
Two new steps to enhance the user experience in the Teams desktop clients (Windows and Mac) will land in mid-January 2025. The first is resizable windows (MC947051, 2 December 2024, Microsoft 365 roadmap item 470431). The second is the ability to pop-out windows the side panes used for chat, Copilot, and Notes in meetings (MC952888, 10 December 2024, Microsoft 365 roadmap item 421607).
I don’t think much needs to be said about pop-out windows in Teams because this facility has been available in different areas of the product for quite some time, Resizable windows are a different matter because the ability to resize the different panes used in the Teams interface has never existed before. It’s a huge change.
Like a Mobile Interface
The current implementation of the Teams desktop client limits the main window, the chat window, and the meeting stage to a minimum of 720 pixels wide. The new limit is 360 pixels by 502 pixels (width and height) or 502 x 360 with “no loss of functionality.” In other words, any menu option available in the old client interface is available in the new, even when windows shrink to the new minimum size.
Another big change is that it will be possible to zoom a Teams window out to a maximum of 400% (Figure 1) to make it easier for visually impaired users to access Teams content.
Both changes are part of Microsoft’s response to the European accessibility act. In this case, Teams comes under the part of the act intended to make computer systems more accessible.
Collectively, the changes can be compared to the kind of resizing possible for apps designed for the many different shapes found on mobile devices.
Snapping Resizable Teams Windows into Position
Like all UI changes, it will take users a little time to become accustomed to resizable windows. No one is forced to resize windows and it’s perfectly possible to continue working with Teams as before. Indeed, some users are likely to discover the availability of resizable windows by accident, perhaps after right-clicking the resize window button when they’ll see Teams offer the standard Windows snap layouts (Figure 2).
If that isn’t good enough, the panes in the Teams window are resizable to create just the right interface for whatever screen configuration you prefer. Figure 3 shows how the screen might look when the main chat window and the channel conversation panes are sized to the minimum width.
The Impact of Resizable Teams Windows on Apps
Notice the hamburger menu in the top left-hand corner. This reveals the apps pane to allow navigation to other areas of Teams, such as the new calendar, which can seem a little squashed when fitted into a small pane. Planner (Figure 4) is another app that benefits when its data is viewed using a wider pane.
Other apps are obviously unprepared for the advent of smaller panes, and developers might have to make some code adjustments to handle Teams resizable windows more elegantly than they will without any changes. This is understandable because I’m sure that none of the 2,854 apps currently available in the Teams app store were created with an eye on resizable windows.
The good news is that chats, meetings, and channel conversations work acceptably. Composing a new message in a small pane is a tad cramped, but if that’s what you need to do to make Teams work on a device, it’s OK.
All UI Changes Cause Some Upheaval
It’s a cardinal rule within the Microsoft Office ecosystem that UI changes cause some degree of upheaval for users. Muscle memory gets in the way when people encounter changes in the way that common applications work. Given that there’s 320 million monthly active users of Teams, the potential exists that a lot of people might need some help to master resizable windows.
As always, it’s best to be proactive about these things. Let people know that the UI change is coming. Explain the advantages for accessibility and sizing Teams for best display on large screens. Show that they don’t have to use resizable windows if they don’t want to, and how users can get back to “regular” Teams if resizing doesn’t work for them. This is a good change that is a positive advance for the client. The task now is to manage the introduction of Teams resizable windows without causing undue disruption for end users.
Kecerdasan Buatan Buat Indonesia Cerdas – Peran AI untuk Masa Depan Indonesia
Doc. Microsoft – AI untuk Indonesia. Ilustrasi ini dihasilkan oleh AI menggunakan Microsoft Designer.
Read in English here
Dengan berakhirnya tahun 2024, sulit untuk tidak bernostalgia dan merenungkan perjalanan luar biasa Indonesia—sebuah bangsa yang terus berupaya mengatasi kesenjangan teknologi untuk kemudian mengadopsi inovasi kecerdasan buatan (AI) di ambang era transformasi besar. Ketangguhan, empati, dan rasa ingin tahu menjadi fondasi perubahan ini. Nilai-nilai inilah yang menunjukkan karakter bangsa kita. Tahun ini membuktikan satu hal penting bagi Indonesia: AI bukan hanya alat, tapi katalis pemicu kreativitas, kolaborasi, dan kemajuan yang nyata.
Microsoft menyambut hangat pemerintahan baru dengan semangat kolaborasi dalam mewujudkan ambisi transformasi digital Indonesia – dipandu oleh komitmen bersama terhadap inklusivitas dan kemajuan. Dari menggerakkan industri hingga memberdayakan individu, AI telah menjadi cerminan kecerdikan bangsa kita, membantu kita membayangkan segala kemungkinan demi negara yang beragam dan dinamis ini.
New Digital Economy Sebagai Landasan Pertumbuhan
Perjalanan Indonesia menuju ekonomi digital baru sebenarnya mencerminkan revolusi besar di masa lalu saat penemuan mesin cetak atau internet. Periode tersebut adalah momen bersejarah yang mengubah masyarakat dan menciptakan peluang baru untuk maju. Teknologi cloud dan AI kini menjadi pusat dari perubahan ini—memungkinkan inovasi dan inklusivitas sambil memberdayakan komunitas di seluruh nusantara. Teknologi-teknologi ini bukan sekadar alat, melainkan penggerak masa depan di mana pemberdayaan digital menyentuh setiap sudut tanah air.
Apakah kita siap untuk transformasi ini? Indonesia menjawab “Ya”. Menurut Work Trend Index 2024 dari Microsoft dan LinkedIn yang diluncurkan pertengahan tahun ini, sebanyak 92% knowledge workers di Indonesia telah menggunakan AI generatif dalam pekerjaan mereka, melampaui rata-rata global (75%) dan Asia Pasifik (83%). Kesiapan ini muncul berkat tingginya rasa ingin tahu dan keberanian bereksperimen yang dimiliki populasi muda nan beragam. Dengan 70% penduduk Indonesia berada dalam kelompok usia produktif, kreativitas dan kolaborasi berkembang pesat. Hal ini terlihat dari lebih dari 3,1 juta pengembang Indonesia di GitHub, komunitas pengembang terbesar ketiga di Asia Pasifik, yang kontribusinya pada proyek AI generatif publik meningkat sebesar 213% di tahun 2023. Hal ini mencerminkan semangat gotong royong, di mana upaya kolektif mengubah tantangan menjadi peluang.
Memperkuat Kreativitas: Kisah Nyata yang Berdampak
Peluang ini bukanlah sekadar teori namun sudah terwujud melalui kreasi para inovator Indonesia, yang rasa ingin tahu dan kecerdikannya mencerminkan kekuatan bangsa. Memasuki tahun kedua AI, fokus telah bergeser dari adopsi AI menuju integrasi AI di berbagai industri utama.
Di berbagai sektor, para inovator ini menggunakan AI untuk menjawab tantangan dan menciptakan solusi nyata, mulai dari memastikan ketahanan pangan hingga mendorong inklusi keuangan. Inklusivitas tetap menjadi dasar dari upaya ini, memastikan bahwa semua orang merasakan manfaat dari inovasi transformatif di berbagai industri, sektor, dan komunitas.
Sebagai contoh, Yayasan Mitra Netra telah mengembangkan Arabic Braille Converter yang didukung oleh GPT-4. Inovasi ini memungkinkan jutaan penyandang tuna netra untuk mengakses informasi dengan lebih mudah.
Di bidang pendidikan, Universitas Terbuka menciptakan AI Assistant yang diintegrasikan ke dalam 1.000 kelas virtual di 10 mata kuliah, menjangkau 60.000 mahasiswa mereka di seluruh provinsi di Indonesia. Inisiatif ini menjembatani kesenjangan dalam akses pendidikan berkualitas, memastikan mahasiswa di daerah paling terpencil pun dapat merasakan peluang belajar yang setara.
Di dunia korporasi, Telkomsel memimpin integrasi AI dengan Veronika, asisten virtual yang didukung oleh Azure OpenAI Service. Dengan mengintegrasikan AI, Telkomsel mencatat peningkatan 140% dalam interaksi layanan mandiri pelanggan, yang menghasilkan solusi lebih cepat dan akurat, serta meningkatkan engagement di produk gaya hidup digital.
Di industri layanan keuangan, BRI telah menerapkan empat kasus penggunaan AI generatif, termasuk chatbot bernama Sabrina yang memberikan informasi keuangan transparan kepada jutaan nasabahnya. Inovasi ini menegaskan bagaimana AI dapat mendorong inklusi keuangan dengan membuat layanan lebih mudah diakses dan efisien.
Startup seperti eFishery juga membuat gebrakan dengan AI. Sebagai startup teknologi akuakultur pertama di Asia yang memiliki misi untuk memerangi kelaparan global, eFishery meluncurkan Mas Ahya (Mas Ahli Budidaya). Solusi yang didukung oleh Azure OpenAI Service ini dirancang untuk memberikan saran dan wawasan kepada petani akuakultur di Asia. Mas Ahya melayani petani dengan berbagai tingkat pengalaman dan menggunakan bahasa sehari-hari. Solusi ini juga mendukung berbagai bahasa daerah, dimulai dari Bahasa Indonesia dan Jawa.
Hackathon yang didukung oleh Microsoft dan mitranya menjadi jalan lain di mana kreativitas lokal bertemu dengan potensi global. Tim AI MISS YOU, juara kedua AI TEACH Regional Hackathon, menggunakan AI generatif untuk membangun pemikiran kritis pada siswa sekaligus melestarikan warisan budaya lokal di Probolinggo sehingga berkontribusi pada ekonomi digital. Proyek lain, NuSantap, yang menjadi pemenang GovAI Hackathon, memanfaatkan AI dan computer vision untuk mengatasi masalah gizi anak, sejalan dengan program pemerintah Indonesia dalam pencegahan stunting.
Contoh-contoh ini secara kolektif menunjukkan bagaimana integrasi AI menjawab tantangan nyata di berbagai aspek kehidupan. Dari mendorong inklusivitas dan meningkatkan pendidikan hingga mentransformasi akuakultur dan memperbaiki layanan keuangan, AI membantu Indonesia mewujudkan ambisinya untuk membangun ekonomi digital yang inklusif dan maju.
Berinvestasi dalam Keterampilan untuk Tenaga Kerja yang Tangguh
Perkembangan ekonomi digital sangat bergantung pada tenaga kerja yang terampil. Dalam hampir tiga dekade terakhir, Microsoft telah memberdayakan 25 juta masyarakat Indonesia dengan keterampilan terkait TIK. Tahun ini, Microsoft meluncurkan program elevAIte Indonesia dalam kolaborasi dengan Kementerian Komunikasi dan Digital (Kemkomdigi) serta berbagai pemangku kepentingan lainnya.
Inisiatif ini bertujuan untuk membekali 1 juta masyarakat Indonesia dengan keterampilan kritis di bidang AI. Fokusnya adalah memberdayakan berbagai pihak—termasuk pemerintah, industri, sektor pendidikan, dan komunitas—dengan alat yang mereka butuhkan untuk menghadapi ekonomi yang semakin digerakkan oleh AI.
Untuk mendukung upaya ini, AI Skills Navigator, sebuah situs web berbasis AI, menyediakan platform yang dipersonalisasi bagi individu untuk mengidentifikasi kesenjangan keterampilan, merancang pengalaman belajar yang sesuai, dan mendapatkan sertifikasi terpercaya. Dirancang untuk memenuhi kebutuhan ekonomi AI yang terus berkembang, platform ini memastikan peserta di semua tahap karier dapat membangun keterampilan praktis yang meningkatkan produktivitas, kreativitas, dan daya saingnya.
Melalui elevAIte Indonesia, Microsoft menegaskan kembali komitmennya untuk mendorong kesetaraan digital, mempersiapkan tenaga kerja agar dapat memanfaatkan infrastruktur penting seperti datacenter region Indonesia Central yang akan segera hadir dan memastikan teknologi benar-benar mendorong pertumbuhan di semua sektor. Tujuannya adalah menciptakan generasi talenta digital produktif yang siap menghadapi dunia yang semakin berorientasi pada AI.
AI yang Bertanggung Jawab dan Aman: Kepercayaan di Pusatnya
Seiring dengan percepatan inovasi, menjaga kepercayaan menjadi hal yang sangat krusial. Untuk itu, lebih dari satu dekade lalu, Microsoft menetapkan Trusted Cloud Principles sebagai pedoman untuk teknologi Microsoft Cloud. Prinsip-prinsip ini mencakup keamanan, privasi, kepatuhan, keandalan/ketahanan, dan hak kekayaan intelektual.
Dalam hal keamanan, Microsoft telah menginvestasikan lebih dari USD20 miliar untuk keamanan siber secara global. Baru-baru ini, sebagai bagian dari Secure Future Initiative (SFI), kami telah menunjuk 13 Deputy Chief Information Security Officers (Deputy CISOs) untuk memimpin implementasi SFI di seluruh perusahaan. Kami juga mengerahkan 34.000 engineer penuh waktu untuk mengintegrasikan keamanan ke dalam setiap pekerjaan mereka—menjadikannya upaya cybersecurity engineering terbesar dalam sejarah. Selain itu, kami meluncurkan Security Skilling Academy untuk melatih semua karyawan dalam keamanan siber dan menjadikan keamanan sebagai prioritas inti dalam penilaian performa karyawan.
Dari segi privasi dan kepatuhan, Microsoft Cloud menawarkan lebih dari 100 solusi kepatuhan, menjadikannya penyedia layanan cloud dengan solusi kepatuhan paling komprehensif. Di Indonesia, selaras dengan Undang-Undang Perlindungan Data Pribadi (UU PDP), kami memperkenalkan Premium Assessment Template untuk UU PDP dalam Microsoft Purview Compliance Manager. Template ini membantu organisasi menyederhanakan upaya kepatuhan, termasuk terhadap UU PDP, dengan mengotomatiskan tugas-tugas kepatuhan yang penting dan menyederhanakan proses penilaian.
Sejalan dengan prinsip-prinsip ini, komitmen kami terhadap Responsible AI mendorong kolaborasi antarorganisasi untuk memastikan sistem AI yang adil, inklusif, dan transparan. Melalui alat seperti Responsible AI Impact Assessment Template, Microsoft membantu bisnis secara kolaboratif mengidentifikasi risiko, membuat upaya pengamanan, dan membangun sistem AI yang sejalan dengan prinsip etika dan nilai-nilai sosial.
Menatap Masa Depan: AI untuk Indonesia
Menyambut tahun 2025—yang juga menandakan capaian krusial bagi Microsoft di Indonesia dan dunia—saya optimis memandang peluang tanpa batas yang ada di depan kita. Dengan kreativitas dan inovasi masyarakat kita sebagai fondasinya, mulai dari kepiawaian generasi muda hingga kekuatan kolaborasi kita, nilai-nilai seperti gotong royong dan rasa ingin tahu terus mendorong kita untuk mencapai tujuan dengan lebih cepat dan lebih inklusif. Dalam konteks ini, AI bukan hanya Artificial Intelligence—tetapi juga Advancing Indonesia (memajukan Indonesia), Amplifying Ingenuity (mendorong kreativitas), dan Accelerating Impact (mengakselerasi dampak).
Hadirnya wilayah Indonesia Central yang akan datang, sebuah infrastruktur penting yang mencerminkan komitmen Microsoft yang lebih luas terhadap negara ini, menjadi bagian tak terpisahkan dari visi ini. Infrastruktur ini, yang akan segera tersedia untuk umum, menjadi bukti peran Indonesia yang semakin besar dalam lanskap ekonomi digital global. Kunjungan Satya Nadella ke Jakarta awal tahun ini menegaskan pentingnya hal tersebut, dengan pengumuman investasi tambahan sebesar USD1,7 miliar untuk memperluas kontribusi Microsoft di Indonesia, baik dalam infrastruktur maupun pengembangan keterampilan.
Investasi ini lebih dari sekadar menyediakan infrastruktur, namun melambangkan masa depan di mana layanan cloud terpercaya yang disesuaikan dengan kebutuhan lokal memungkinkan peningkatan data sovereignty (kedaulatan data), keamanan dan kepatuhan kelas dunia, serta inovasi berbasis AI yang lebih cepat. Bagi Indonesia, ini berarti peluang untuk mencapai posisi puncak dalam ekonomi AI global, memastikan bahwa bisnis, komunitas, dan individu dapat berkembang.
Di Microsoft, kami bangga bergandeng tangan bersama para penggerak perubahan di Indonesia, terus berinvestasi pada manusia, infrastruktur, dan teknologi yang memberdayakan setiap individu untuk mencapai lebih banyak. Bersama, mari kita bentuk masa depan yang inovatif, inklusif, dan tangguh.
###
AI for Indonesia: Amplifying Ingenuity, Empowering Communities, Transforming Futures
Doc. Microsoft – AI for Indonesia. This is an AI-generated image by Microsoft Designer.
As we close 2024, I reflect on Indonesia’s remarkable journey thus far – a nation that has overcome challenges in equal access to technology and resources to embrace AI innovation and stand at the threshold of a transformative era. Resilience, empathy, curiosity, and unyielding have underpinned this transformation, showcasing the best of our values. This year has indeed demonstrated the potential of AI for AI—Advancing Indonesia, not just as a tool but as a catalyst for creativity, collaboration, and progress.
Microsoft warmly welcomes the new government administration and is excited about the opportunities to collaborate in achieving Indonesia’s ambitious digital transformation goals – guided by a shared commitment to inclusivity and progress. From shaping industries to empowering individuals, AI reflects our nation’s resourcefulness, helping us reimagine what’s possible for our diverse and dynamic nation.
The New Digital Economy: A Foundation for Growth
Indonesia’s journey toward a new digital economy mirror past revolutions like the printing press or the internet – moments that reshaped society and created new opportunities for progress. Today, cloud and AI technologies are at the heart of this transformation, enabling innovation and inclusivity while empowering communities across the archipelago. These technologies are not just tools—they are enablers of a future where digital empowerment touches every corner of the nation.
Are we ready for this transformation? Indonesia says yes – 92% of knowledge workers in Indonesia already use generative AI at work, surpassing global (75%) and Asia Pacific (83%) averages, according to the Microsoft and LinkedIn Work Trend Index 2024 that we launched mid- year. This readiness is deeply rooted in Indonesia’s spirit of curiosity and experimenting new things, shaped by its youthful and diverse population. With 70% of Indonesians in the working-age group, creativity and collaboration thrive. This is exemplified by over 3.1 million developers on GitHub, the third-largest developer community in Asia-Pacific, whose contributions in the number of public generative AI projects on the platform grew by 213% in 2023 alone. Such ingenuity highlights the gotong royong spirit, where collective efforts turn challenges into opportunities.
Amplifying Ingenuity: Real Stories of Impact
These opportunities are not theoretical—they are already being realized through the ingenuity of Indonesia’s innovators, whose curiosity and resourcefulness reflect the nation’s strength. As we move into Year 2 of AI, the focus has shifted from AI adoption to AI integration across key industries, driving the new AI economy in Indonesia. Across sectors, innovators are applying AI to solve challenges and create meaningful impact, from ensuring food security to fostering financial inclusion.
Inclusivity remains a cornerstone of these efforts, ensuring that everyone benefits from transformative innovations spanning diverse industries, sectors, and communities. AI-powered innovations are helping startups, enterprises, NGOs, educational institutions, governments, and individuals alike tackle pressing challenges and unlock new opportunities in Indonesia’s digital transformation journey.
Yayasan Mitra Netra, for example, has developed an Arabic Braille Converter powered by GPT-4, enabling millions of visually impaired individuals to access information seamlessly.
In education, Universitas Terbuka has created an AI Assistant integrated into 1,000 virtual classrooms across 10 subjects, reaching 60,000 students across Indonesia’s provinces. By bridging the gap in access to quality education, this initiative ensures that students in even the most remote areas can benefit from equal learning opportunities.
For enterprises, Telkomsel is leading the way with Veronika, its virtual assistant powered by Azure OpenAI Service. By integrating AI, Telkomsel has seen a 140% increase in customer self-service interactions, with quicker and more accurate solutions driving improved engagement for digital lifestyle products.
In the financial sector, BRI is implementing four generative AI use cases, including a chatbot named Sabrina that provides transparent financial information to millions of Indonesians. This innovation underscores how AI is fostering financial inclusion by making services more accessible and efficient.
Startups like eFishery are also changing the game with AI. The first aqua technology startup based in Asia with a mission to combat world hunger has launched Mas Ahya (Mr. Cultivation Expert). The solution, powered by Azure OpenAI Service, is designed to provide advice and insights to Asian aqua farmers. It caters to farmers with varying levels of experience and uses everyday language. It also supports multiple local languages, starting with Bahasa Indonesia and Javanese.
Hackathons supported by Microsoft and its partners are another avenue where local creativity meets global potential. The AI MISS YOU team, runners-up of the AI TEACH Regional Hackathon, used generative AI to inspire critical thinking in students while preserving local heritage in Probolinggo, thereby contributing to the digital economy. Similarly, the NuSantap project, a winner of the GovAI Hackathon, leverages AI and computer vision to address child nutrition, aligning with Indonesia’s government programs for stunting prevention.
These examples collectively highlight how AI integration is addressing real-world challenges across sectors. From fostering inclusivity and improving education to transforming aquaculture and enhancing financial services, AI is helping Indonesia realize its ambitions for a thriving, inclusive digital economy.
Investing in Skills for a Resilient Workforce
A thriving digital economy depends on a skilled workforce. In almost the past three decades, Microsoft has empowered 25 million Indonesians with ICT-related skills. This year, Microsoft introduced the elevAIte Indonesia program in collaboration with the Ministry of Communication and Digital Affairs (Kemkomdigi) as well as other stakeholders.
This initiative aims to equip 1 million Indonesians with critical AI skills. It focuses on empowering diverse groups—including government, industries, education, and communities—with the tools needed to navigate an increasingly AI-driven economy.
To support this effort, the AI Skills Navigator, an AI-powered website, provides learners with a personalized platform to identify skill gaps, tailor their learning journeys, and access trusted certifications. Designed to meet the demands of the evolving AI economy, this platform ensures participants across all career stages can build practical skills that enhance productivity, creativity, and employability.
Through elevAIte Indonesia, Microsoft reaffirms its commitment to fostering digital equity, preparing a workforce to capitalize on critical infrastructure like the upcoming Indonesia Central region, ensuring that technology drives growth across all sectors. The goal is to have a generation of productive digital talents ready to take on an increasingly AI-oriented world.
Responsible AI and Security: Trust at the Core
As innovation accelerates, maintaining trust remains paramount. As such, since more than a decade ago, Microsoft has established our Trusted Cloud Principles to guide our Microsoft Cloud technology. These principles include security, privacy, compliance, reliability/resiliency, and intellectual property.
When it comes to security, Microsoft has committed over $20 billion to cybersecurity globally. Most recently, as part of our company’s Secure Future Initiative (SFI) which promises to prioritize security above all else, we have appointed 13 Deputy Chief Information Security Officers (Deputy CISOs) responsible for spearheading SFI across the company, mobilized 34,000 full-time engineers to integrate security into the fabric of their work (making it the largest cybersecurity engineering effort in history), launched Security Skilling Academy to help train all employees on cybersecurity, and implemented the security core priority as a performance measure for all employees.
Meanwhile in privacy and compliance, Microsoft Cloud is providing more than 100 compliance offerings, making it the most comprehensive set of compliance offerings of any cloud service provider. Most recently in Indonesia, aligning with the Personal Data Protection Law (UU PDP), we introduced the Premium Assessment Template for Indonesia’s PDP Law in Microsoft Purview Compliance Manager. This template can help organizations in streamlining their overall compliance efforts, including to PDP Law, by automating critical compliance tasks and simplifying the assessment process.
Aligning with all these principles is Responsible AI commitment, which fosters collaboration among organizations to ensure AI systems are fair, inclusive, and transparent. Through tools like the Responsible AI Impact Assessment Template, Microsoft empowers businesses to collaboratively identify risks, establish safeguards, and build AI systems that align with ethical principles and societal values.
A Vision for the Future: AI for Indonesia
As we look toward 2025 – which coincides with a very special milestone for Microsoft in Indonesia and globally – I am inspired by the boundless opportunities ahead, grounded in the creativity and innovation of our people. From the ingenuity of our youth to the strength of our collaborations, values like gotong-royong and curiosity continue to drive us toward achieving our goals faster and more inclusively. AI, in this context, is not just Artificial Intelligence—it is Advancing Indonesia, Amplifying Ingenuity, and Accelerating Impact.
Central to this vision is the upcoming Indonesia Central Region, a critical piece of infrastructure that reflects Microsoft’s broader commitment to the country. Now nearing general availability, this region is a testament to Indonesia’s growing role in the global digital economy. Satya Nadella’s visit to Jakarta earlier this year underscored this importance, with the announcement of an additional $1.7 billion investment to expand Microsoft’s efforts in Indonesia in terms of infrastructure and skilling.
These investments go beyond infrastructure. They symbolize a future where trusted cloud services tailored to local needs enable enhanced data sovereignty, world-class security and compliance, and faster AI-driven innovation. For Indonesia, this means opportunities to leapfrog into a leadership position in the global AI economy, ensuring that businesses, communities, and individuals thrive.
At Microsoft, we are proud to stand alongside Indonesia’s changemakers, continuing to invest in the people, infrastructure, and technologies that empower every individual to achieve more. Together, let us shape a future defined by innovation, inclusivity, and resilience.
###
Microsoft 365 Users to Get the Org Explorer in Outlook
Outlook Classic. OWA, and the New Outlook All Get the Org Explorer
Now that we’ve all recovered from the news about the retirement of Viva Goals, a possibly more important change in the world of Viva is the removal of the requirement for a Viva Suite license for access to the Org Explorer feature in Outlook (Figure 1). Microsoft introduced the need for potential Org Explorer users to have a Viva Suite license in February 2023 after originally saying that a Microsoft 365 E3 or E5 license was sufficient.
According to MC939925 (last updated 5 December 2024), rollout of Org Explorer to Outlook users will start in mid-January 2025 and complete by mid-April 2025. The Org Explorer is available for Outlook classic, OWA, and the new Outlook for Windows. Microsoft 365 roadmap item 421191 says that the feature is available to all Microsoft 365 commercial customers, which implies that anyone with a paid-for Microsoft 365 license can use the Org Explorer.
The Need for Directory Sanity
I never understood why Microsoft decided that it was a good idea to license the Org Explorer as a premium Viva feature. The explorer reveals the same kind of information that’s shown by the Microsoft 365 user profile card (without the ability to add custom properties to what’s displayed about users).
It seems like the folks who put together the Viva licensing strategy cast around to find features they could include to justify premium pricing and decided that the Org Explorer was a good fit. It’s yet another of the Microsoft 365 licensing oddities, like demanding an E5 license to add a default retention or sensitivity label to SharePoint document libraries. I had a Viva Suite license at one point, which is how I tested access to the Org Explorer, but after losing that license, I never noticed that the Org Explorer was no longer available in Outlook, which summarized the value I received from the feature.
Even though I might not have discovered much value in the Org Explorer, I think it’s fair to say that those working in large enterprises, especially when offices are distributed and/or multinational, might consider the Explorer to be a useful tool. Like user profile cards, the usefulness of something like the Explorer is highly dependent on the accuracy of the information stored in Entra ID. For instance, if reporting relationships (managers and direct reports) are not maintained in Entra ID, it’s impossible for a tool like the Org Explorer to build a coherent view of the organizational structure.
Some organizations prefer to store reporting relationships in HR databases and don’t synchronize this information with Entra ID. In such a situation, the view of the organization constructed by the Org Explorer is unlikely to be helpful or accurate.
Outlook’s Toggle into the Future
Speaking of Outlook classic, in MC949965 (December 6, 2024), Microsoft says that in April 2026, they will “toggle” enterprise users of Outlook classic to use the new Outlook for Windows. Fortunately, users will be able to recognize Microsoft’s mistake and immediately switch back if they choose. Conditions that will prevent automatic toggling include:
- Tenants hide the switching toggle. Hiding the toggle is the easiest way to stop Microsoft automatically moving Outlook classic clients to the new Outlook.
- Tenants choose an admin-driven migration.
- Outlook accesses on-premises mailboxes.
Microsoft wants to give users the opportunity to try the new Outlook, something that might be better appreciated if the client worked better than it does now. New features like pinning and snoozing messages might be appreciated by some, but I suspect that many in the Outlook community don’t care too much about these things.
Still, who knows what might transpire between now and fifteen months’ time? All the lingering issues that stop people switching now might be solved and everyone will be happy to adopt the new client before Microsoft support for the classic client ceases in 2029.
Change Keeps on Happening
Product retirements, licensing changes, and client upgrades are just part and parcel of Microsoft 365 life. It’s hard to keep track of everything that happens. Even we have a hard time, and we’ve been tracking the ins and outs of change across Office 365 and Microsoft 365 since 2014.
Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.
300,000+ Prometheus Servers and Exporters Exposed to DoS Attacks
In this research, we uncovered several vulnerabilities and security flaws within the Prometheus ecosystem. These findings span across three major areas: information disclosure, denial-of-service (DoS), and code execution. We found that exposed Prometheus servers or exporters, often lacking proper authentication, allowed attackers to easily gather sensitive information, such as credentials and API keys.
In this research, we uncovered several vulnerabilities and security flaws within the Prometheus ecosystem. These findings span across three major areas: information disclosure, denial-of-service (DoS), and code execution. We found that exposed Prometheus servers or exporters, often lacking proper authentication, allowed attackers to easily gather sensitive information, such as credentials and API keys. Read More
Configure Sensitivity Labels to Block Document Downloads from SharePoint
Easier Than Running Set-SPOSite to Configure Individual Sites with the Block Download Policy
In February 2023, I wrote about the SharePoint Online Block Download policy. At the time, the only way to assign the block download policy to a site was to run the Set-SPOSite cmdlet to update site settings. This isn’t a difficult operation and it’s likely that relatively few sites contain the level of confidential information that creates the need to block users from downloading documents.
Using PowerShell to maintain the block access policy for individual sites is not a problem. However, managing which sites have a block download policy is easier with a container management label. If configured for a container management label, SharePoint Online applies the block download policy automatically along with all the other controls set in the label to each site that receives the label.
Configuring a Container Management Label to Block Downloads
When Microsoft introduces new controls to control site behavior through container management labels, PowerShell is often the initial method chosen to apply the settings. External sharing is an example of a setting first enabled in PowerShell and later configurable through the GUI for sensitivity labels in the Microsoft Purview portal. Even though the block download policy has been available for a while, the block download policy is still considered an advanced setting that must be configured through PowerShell.
The first step is to connect to Exchange Online PowerShell and to the compliance endpoint:
Connect-ExchangeOnline Connect-IPPSSession
To update the block download policy, run the Set-Label cmdlet to configure the advanced settings for the labels that will apply the control. In the following example, I configure settings for a label with the display name Limited Access to:
- Set the block download policy to True (the policy is active).
- Exclude site owners from the block download policy.
- Exclude the members of a selected group from the block download policy. Pass the object identifier for the group. If you want to specify several groups, separate the object identifiers with commas. You can use security or Microsoft 365 groups.
Set-Label -Identity 'Limited Access' -AdvancedSettings @{BlockDownloadPolicy="true"}
Set-Label -Identity 'Limited Access' -AdvancedSettings @{ExcludeBlockDownloadPolicySiteOwners = "true"}
Set-Label -Identity 'Limited Access' -AdvancedSettings @{ExcludedBlockDownloadGroupIds="2c2f5287-a88a-4e14-ba22-503d8b0bf3b3"}
The Effect on Users
After updating label settings, it takes about 24 hours for the policy to become effective. A background timer job detects that new label settings are available and applies them to the sites with the label. Afterward, when a user opens a site with a label that contains the block download policy settings, SharePoint Online checks if the user is a site owner or is on the excluded user list. If not, SharePoint Online applies the block download policy, and the user is restricted to working with content online (Figure 1).
The most obvious effect of the block download policy is that users must edit Office files with the browser apps. This is because SharePoint cannot download temporary copies of files for the Office desktop apps to work with.
If you don’t know if sites have assigned container management labels, run the script described in this article. For more details about how the Block Download policy works, read Microsoft’s documentation.
Advantages of Policy Assignment via Sensitivity Labels
The advantage of applying settings through sensitivity labels is obvious: once an administrator assigns a label to a container, the container inherits all the label settings. There’s no need for administrators to discover the syntax to apply individual settings to sites. You still can apply the block download policy to sites by running the Set-SPOSite cmdlet, but policy assignment via sensitivity labels is more convenient and less prone to error. It also means greater consistency in site settings because administrators know that once they apply a container management label to a site, the site automatically picks up all the settings from the label.
Using the Block Download policy requires the Microsoft SharePoint advanced management license for all users who “benefit from the policy.” In other words, anyone who connects to a site where the policy is active must have an appropriate license.
Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.
February Deadline Looms for Legacy Exchange Tokens Used in Outlook Add-Ins
Code Replacement Deadline for Exchange Legacy Tokens Approaching
In May 2024, I wrote about the upcoming change for the authentication method used by Outlook add-ins to embrace a technology called Nested App Authentication (NAA), which is used by ISVs and other developers to obtain access tokens to interact with Exchange through the Outlook REST API or Exchange Web Services (EWS).
Microsoft originally wanted to disable legacy Exchange tokens in October 2024. As tends to be the nature of these projects, customers needed some extra time. However, we’re now on the glidepath to complete disablement for legacy Exchange tokens across Microsoft 365 and Microsoft plans to turn off Exchange legacy tokens for all tenants in February 2025. The exact timing for when a client ceases to support legacy Exchange tokens depends on the Office channel in use (see the timeline for the different Office channels).
What Happens in February 2025
After February 2025, tenants can reenable Exchange legacy tenants using PowerShell. This action grants access until June 2025. At that point, Microsoft will disable Exchange legacy tokens again and tenants will only be able to reenable tokens through an appeal process. If granted, the tenants can use legacy Exchange tokens until Microsoft finally removes the functionality from Microsoft 365 in October 2025. That seems like a long time away, but given the effort required to find and deploy replacement add-ins to Outlook classic clients, tenants need to be in control of the process before the first phase of token disablement happens.
Although Microsoft is going through its normal process of publishing documentation, issuing message center notifications, and so on, one wonders if the message about removing support for Exchange legacy tokens is getting through. This is important because this change will eventually cause Outlook or OWA add-ins to stop working for many Outlook users if action is not taken.
Knowing What Add-Ins Are in Use
Microsoft has collated information about the Outlook add-ins known to be in use inside Microsoft 365. That information is available in a downloadable Excel worksheet (Figure 1). Additional reporting is expected in early 2025.
The first thing to do is to download and analyze the worksheet to identify what add-ins are in use within the tenant and who developed the add-in. At this stage, you must run several cmdlets (see instructions here) to discover the add-ins deployed in your tenant.
Often the author will be an ISV like SAP who understands the problem and has already created a replacement add-in based on NAA, the new way for add-ins to authenticate and receive access tokens from Entra ID. Some other add-ins might be authored by in-house developers, in which case the responsibility for updating the add-in code lies with the tenant. Microsoft’s documentation highlights some API calls that developers need to pay special attention to because they indicate the use of legacy Exchange tokens.
Some add-ins might have been developed by a company that’s now out of business. In these cases, the add-in will cease working once Microsoft disables legacy Exchange tokens and there’s no path forward except to find (or develop) a replacement add-in.
It Would Have Been Better to Start Earlier
Change is never easy, especially when it involves code that’s installed and run in a client like Outlook classic that’s been around for a very long time. There’s no easy workaround either when the problem involves a fundamental change in authentication and access that must be addressed in a code update.
Given the timeline, the important thing is to start the assessment process as quickly as possible. Identifying the set of add-ins in active use is critical, as is knowing where the necessary code updates will come from. After that it’s a mere matter of deploying the updates to individual workstations, which is always the easiest part of projects.
Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.
New Option Available to Update Microsoft 365 User Profile Details
Find Your Account with Microsoft Search to Update Your Details
Delve is scheduled for retirement on December 16, 2024. As noted previously, when Delve retires, users need a different mechanism to update their profile settings. Microsoft said that the replacement for user profile updates will be available through Microsoft search and promised that the replacement would be available before the demise of Delve. The option to update user profiles has duly arrived and should now be available in tenants.
The new option hasn’t yet replaced the My Microsoft 365 profile accessed by clicking the user profile photo in the top right-hand corner of Microsoft 365 browser interfaces. I’m sure that this will happen, but in the interim, you’ll need to go to Office.com and search to find your user profile. When you view your profile, you should see the option to Update your profile (Figure 1).
Eventually, the option to update user profile settings should appear in all apps where users can currently view their profile card.
Updating User Details
Generally speaking, updating a user profile is straightforward. Some updates show up faster when people view the user profile than the 24 hours expectation set by Microsoft when saving new values for the profile (Figure 2).
A Mixture of Properties
My issue with the current implementation is that it still surfaces some elements of the old SharePoint profile. For instance, if you click the link to “add more profile information,” you’re brought to the old Edit Details screen. For most tenants, there’s nothing on this screen that cannot be changed with the update profile screen, so I’m unsure what extra value the link delivers. Perhaps it’s to serve tenants who add custom user profile properties to SharePoint Online.
The duplication of some common properties shown on the profile card is more worrisome. Most properties relating to the organizational information stored about users is held in Entra ID, which is the authoritative source for directory information within Microsoft 365. These properties include the job title, department, company name, office location, and business address. They also include contact information like numbers for home, business, and mobile phones.
The issue is that the user profile card displays two sets of telephone numbers. One set are the values stored in Entra ID; the other are stored in SharePoint Online. Users can’t update Entra ID, but they can update their home and mobile numbers in the profile information in SharePoint (Figure 3). Oddly, users can update the business fax information in SharePoint Online, but the equivalent from Entra ID isn’t even shown.
Perhaps the desire is to allow users to publish both official (Entra ID) and unofficial contact details. That could very well be a good idea, if the same names weren’t used. For instance, Figure 4 shows my user profile. There are two values listed for mobile phone and business fax. Entra ID doesn’t store home phone numbers for users, so the profile uses the data from SharePoint Online.
A Missed Opportunity
While acknowledging that the implementation now being rolled out is to assist in the retirement of Delve by replacing how users update profile information, it seems like failing to rationalize the information displayed on the user profile card is a missed opportunity.
Most Microsoft 365 tenants don’t add custom user profile properties to SharePoint Online. The feature is a legacy inherited from the on-premises server that should be replaced by easier customization for user accounts within Entra ID. Given the core position of Entra ID within the Microsoft 365 ecosystem, it just doesn’t make sense to persist with a mechanism that, as far as I can tell, isn’t widely used.
You can add custom directory extensions or schema extensions to Entra ID, but using the extensions isn’t as easy as it should be. For instance, there’s no way to customize the user profile card to add custom directory or schema extensions in the same way as supported for Exchange custom attributes. It would be nice if Microsoft made it easy for administrators to create tenant-specific versions of the user profile card and for users to update their details. It’s possible to create and update profile cards today, but pulling everything together is just more complicated than it should be.
Learn more about how the Office 365 applications really work on an ongoing basis by subscribing to the Office 365 for IT Pros eBook. Our monthly updates keep subscribers informed about what’s important across the Office 365 ecosystem.
Microsoft Kills Viva Goals
Viva Goals Retirement To Happen on December 31, 2025
Viva Goals is an implementation of the Objections and Key Results (OKR) methodology to allow organizations to define and measure progress against goals (the OKRs) set at the organization or team level. Goals wasn’t part of the original launch for Microsoft’s Viva employee engagement suite in February 2021. As part of its work to extend the Viva suite Microsoft acquired Ally.io in October 2021. The technology was subsequently rebranded as Viva Goals and reached general availability in August 2022.
Microsoft’s decision to retire Viva Goals came like a bolt from the blue. The first public indicator emerged when Microsoft published MC949603 in the Microsoft 365 admin center on December 5 along with a companion explanatory article to let customers know that Microsoft ceased development for Viva Goals on December 5, 2024 and will retire the product on December 31, 2025. Microsoft also said that no prospect exists to extend access to Viva Goals past the retirement date.
Looking back, the resignation of Ally.io founder Vetri Vellore from Microsoft in December 2023 might be seen as an early indicator that things weren’t going so well with Viva Goals. Vellore is now leading the development of Rhythms.ai, an “AI-powered operating system for high-performing teams.” It’s not unusual for founders of acquired companies to depart after their retention agreement expires, and Vellore departing to set up another startup fits the pattern. However, it probably didn’t help. Losing leadership is never good for a struggling product.
Why Forced the Viva Goals Retirement?
When it announces decisions, Microsoft often stresses its use of telemetry acquired from user activity to inform those who make the decisions. In this case, Microsoft says that “While some customers have recognized value, overall adoption and usage of Viva Goals across the Viva Suite customer base has not grown. Microsoft has been unable to reach the scale and impact needed to continue further investment.” In other words, some customers like Viva Goals but not enough have opted to use it to warrant further development.
Given the scale that Microsoft 365 runs at, it’s unsurprising that Microsoft has high hopes for new products. If products don’t attract substantial customer interest, the potential for failure and retirement always exists. Introducing OKRs into an organization is not like launching an application like Planner. According to some successful practitioners, executive buy-in and leadership is needed to drive the adoption of the methodology. Support from the top of the organization can’t be half-hearted or inconsistent. It’s got to be fully committed and ongoing, and while some customers are enthusiastic about OKRs, it’s obvious that most didn’t view Viva Goals as an important part of their cloud infrastructure.
The most recent usage number revealed by Microsoft was that the Viva Suite had 35 million monthly active users (July 2023). However, Microsoft did not specify usage data for individual products within the suite. The situation is further complicated because Viva Engage (Yammer) components like the Q&A app show up in Teams and might accrue some usage through that route. Another example of how Viva Engage embraces Teams in a way that should drive usage is the support for storylines in Teams chat announced at Ignite 2024 and due for availability in early 2025.
The Second Viva Element to Fall
Viva Goals is the second element of the Viva Suite to be axed following another surprise decision to retire Viva Topics earlier this year. In the case of Viva Topics, Microsoft pointed to Microsoft 365 Copilot as a replacement. Since the announcement, Microsoft has delivered features like custom agents to allow tenants to develop their own form of knowledge infrastructure, albeit for much higher license costs.
The path forward for customers who use Viva Goals is less obvious. In the FAQ for the Viva Goals retirement, Microsoft says that they are “exploring third-party solutions and partnerships to facilitate a smoother transition.” It seems like a lot of work needs to happen between now and December 2025 to create migration tools to export data from Viva Goals to other platforms. We’ll have to see how the transition unfolds.
More Disruption in Viva?
The retirement of two products from the Viva suite might cause some to think that it’s not worthwhile to invest any more time into Viva products. That’s an understandable feeling. Given the way that Microsoft has demonstrated absolute ruthlessness in cutting underperforming products from its portfolio, the future of any Viva product is certainly something to consider. The current line-up is:
- Viva Connections
- Viva Engage
- Viva Amplify
- Viva Pulse
- Viva Glint
- Viva Insights
- Viva Learning
Seven products seem like too many. It’s certainly confusing at times to understand what each product does. It will be interesting to see if Microsoft trims the line-up further in 2025.
So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.
Thwarting Social Engineering Attacks Against Teams Federated Chat
Help Desks Don’t Use Federated Chat – But Attackers Do
A recent ReliaQuest report describes how attackers have started to use social engineering to reach out to Teams users via federated chat (1-to-1 external access) using display names crafted to make the users believe that they’re communicating with help desk staff. It’s a curious development in some respects because Microsoft clamped down on misuse of Teams federated chat from trial tenants in June 2024. Tenants now need paid licenses to use federated chat, with the idea being that if someone hands over a credit card to pay for subscriptions, they’re less likely to be an attacker.
The new block had some unexpected consequences. Since its implementation, people have tried to find ways around the block through various licensing arrangements that we don’t need to discuss in detail here. Obviously, the attackers must not be using a trial tenant.
Known Weaknesses for Attackers to Exploit
Security researchers first highlighted the potential weakness in federated chat some years ago through the GIFShell and JumpSec exploits, both of which were more of a research demonstration rather than a real attack.
Even so, the demonstrations were sufficient to cause some to question Microsoft’s default configuration for Teams which allows open access for federated chat with any other Microsoft 365 tenant that supports Teams. Given that Teams has 320 million monthly active users (a number that Microsoft hasn’t changed since October 2023), that figure implies that connections are available to most other Microsoft 365 tenants.
Open External Access for Teams is Asking for Trouble
I’m on record as saying that I don’t think it is wise for tenants to allow open access for federated chat. It seems better to secure external access by limiting federated connections to a set of known domains. Using an allow list for external access will block attempts to connect from unexpected tenants, but it comes with a price: the requirement to maintain the allow list.
PowerShell updates can reduce the work required to maintain the allow list. For instance, a good start is to populate the allow list with the domains belonging to guest accounts known to the tenant. Another approach is to find the tenants that users already communicate with using federated chat and build the allow list from those domains.
Teams is careful about warning users when connections come in from unknown sources. Sometimes, it even warns of inbound federated chat from a very well-known source, such as the warning shown in Figure 1 when Tim McMichael from Microsoft wanted to chat with me.
The warnings for unexpected contacts coming in through federated chat will be strengthened when Microsoft rolls out Brand impersonation protection for Teams messaging (see message center notification MC910976, last updated 27 November 2024, Microsoft 365 roadmap item 421190).
Brand impersonation protection means that users will be alerted if a new connection comes in from an external domain that impersonates a brand “commonly targeted by phishing attacks.” When this happens, Microsoft signals the potential risk and advises the user to proceed with caution and they’ll be forced to preview the message before deciding to accept or block the contact. In some respects, this is like what happens when Outlook alerts users when the email address from a new sender resembles the email address of someone that they already communicate with.
Brand Impersonation Block Rolling Out
Targeted release tenants already have brand impersonation protection. Microsoft says that they expect to complete worldwide deployment by mid-December 2024. Warnings about heightened risk are very helpful but users can still choose to go ahead and accept the connection. That’s why I still think it’s better to operate a known allow list for Teams external access.
Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.
Microsoft 365 Unifies Video Under Clipchamp Brand
Unified Microsoft 365 Video Start Page Rolling Out Now
Microsoft’s November 26 announcement that they plan to combine Clipchamp and Stream “into a single, streamlined video solution that harnesses the strength and usage of both platforms” is a development that marks the natural conclusion of a process that started with the Clipchamp acquisition (September 2021). The unification will happen under the Clipchamp brand, starting with the launch of a new Microsoft 365 video start page (Microsoft 365 roadmap item 468289). The new page (Figure 1) is already shown in tenants when users select the Stream or Clipchamp options from the Microsoft 365 menu.
The Many Steps to Microsoft 365 Video Unification
As noted above, the unification marks the completion of work that’s been ongoing for several years. Stream migrated video content from the original Office 365 Video portal to its own Azure-based storage. Stream then made the leap to move its files to the SharePoint Online and OneDrive for Business (ODSP) platform, a process that completed earlier this year.
Recent work on Stream has focused on building out player capabilities rather than video editing. Stream can trim a video by hiding parts of a file from user view, but it can’t handle the kind of sophisticated video production tasks that Clipchamp specializes in and are found in competing products like Camtasia.
While the Stream migration to ODSP was ongoing, Microsoft absorbed Clipchamp. Although they haven’t described the technical details of the work done to allow Clipchamp to embrace and use the Microsoft 365 framework, anyone with any knowledge of how Microsoft 365 works can imagine the challenges that flowed after Microsoft’s July 2023 announcement that Microsoft 365 tenants would get the application.
Using Entra ID for authentication and role assignments, supporting multifactor authentication, and moving storage to ODSP are three obvious work items. However, the work to allow users to access Clipchamp and store video files is only the tip of the iceberg and lots of detailed work happened under the surface to ensure that Clipchamp works smoothly within Microsoft 365. At the same time, Clipchamp Consumer continues and needs to be maintained.
Coming Soon
Microsoft promises that the unified offering will continue to deliver more than video editing. For instance, the announcement discusses the ability to share a clip from within a video. Essentially, this means that a user can select a start and end time for a clip and send that detail to other users to allow the recipients to play the video from a precise location for a specified time. The advantage cited is that this removes the need to edit the video and store a file for short (or long) clips.
Microsoft also says that the lightweight video recorder currently available in Stream will be able to call Clipchamp to edit the output. This is referred to as advanced editing from camera and is due for release in January 2025.
Finally, Microsoft notes that the ability to capture and insert video content is available in Outlook. Well, it is in the new Outlook for Windows and OWA but not in Outlook classic. Perhaps the folks who continue to use Outlook classic are content to communicate using words rather than a video clip. As Figure 2 shows, filming a clip is invoked using the Record button (which becomes available when positioned in the message body.
The video clip sent in the email is captured in a Loop Stream component stored and shared from the RecordingsVideo Clips folder in the sender’s OneDrive for Business account. This is the same folder used to hold video clips recorded in Loop pages or other components. If a recipient uses Outlook classic, they can launch the Stream player to view the file.
Microsoft 365 Video Unification is Positive
It didn’t make sense to have two video solutions within Microsoft 365. Unifying around a single brand makes perfect sense. Although it was originally launched for consumers, the Stream brand never worked in that market. Bringing things together under Clipchamp removes confusion and clarifies how video is managed inside Microsoft 365. It’s a positive development.
So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.
From Theory to Practice: How to Make DevSecOps Work in Your Organization
Houston, we have a problem: implementing DevSecOps isn’t as straightforward as it seems.
DevSecOps has redefined security in modern software development, becoming the benchmark for organizational success. By embedding security into every phase of the development lifecycle, organizations can deploy faster and collaborate more efficiently while ensuring security at every step. Yet, despite its advantages, according to IDC’s 2024 DevSecOps and Software Supply Chain Security Survey, only 66% of application development teams use DevSecOps methodologies on average. If it were easy to implement, that number would be much closer to 100%. So, what’s holding teams back? Let’s explore the most common challenges—and how to address them.
Houston, we have a problem: implementing DevSecOps isn’t as straightforward as it seems.
DevSecOps has redefined security in modern software development, becoming the benchmark for organizational success. By embedding security into every phase of the development lifecycle, organizations can deploy faster and collaborate more efficiently while ensuring security at every step. Yet, despite its advantages, according to IDC’s 2024 DevSecOps and Software Supply Chain Security Survey, only 66% of application development teams use DevSecOps methodologies on average. If it were easy to implement, that number would be much closer to 100%. So, what’s holding teams back? Let’s explore the most common challenges—and how to address them. Read More
Switch OneDrive for Business Accounts to Intelligent Versioning
Bringing Intelligent Automatic Versioning to OneDrive for Business
In October, I reported about the deployment of intelligent versioning for SharePoint Online and noted that I thought this is a significant advance for storage management. Some of the gloss is taken off by the clash between retention processing and intelligent versioning. The former wants to keep versions while the latter seeks to remove unwanted versions. Still, anything that seeks to relieve the pressure on expensive SharePoint Online storage is appreciated, and I think intelligent versioning is the way forward.
OneDrive for Business Storage
Because Microsoft makes generous amounts of storage quota available for OneDrive for Business users, less pressure arises through the cost of storage. Microsoft has dedicated a lot of effort to move the files generated by apps such as Loop (components), Whiteboard, and Stream to OneDrive for Business with the idea being that OneDrive is your personal storage space. Sometimes too much gets stored in OneDrive, such as the selection of OneDrive by PowerShell as the default location to install new modules, but overall, it’s a good thing to have a common default storage location for personal files.
Enabling Intelligent Versioning Manually
Which brings us to the question of whether it’s possible to enable automatic versioning for OneDrive for Business. The answer is yes. You can enable intelligent versioning manually or with PowerShell.
To enable an account manually:
- Sign into the account and access site settings through the cogwheel icon.
- Select OneDrive Settings.
- Click More Settings and then choose the link to Return to the Old Site settings page.
- Select Site Libraries and Lists.
- Click on the link to the default document library. In English, the link is Documents.
- Choose Versioning settings.
- Select Automatic versioning (Figure 1) and click OK.
Enabling Intelligent Versioning with PowerShell
Enabling an important feature manually is boring when it needs to be done for many OneDrive for Business accounts. PowerShell is the go-to tool for automating Microsoft 365 administrative operations, so that’s the next step. Despite explaining how to use the SharePoint Online management module to enable intelligent versioning for SharePoint Online sites in my article, I began by investigating if it is possible to do the job with the PnP module. One good reason for selecting PnP is because this module offers more access to SharePoint settings than any other route.
I started by connecting to a OneDrive for Business account by using the Get-MgUserDrive cmdlet to find the OneDrive account for a user account, trimming the OneDrive URL to the form required by PnP, and connecting. If you’re not a regular user of PnP, a recent change in the multitenant app used by the module means that interactive connections are handled differently. After connecting, I was able to run Get-PnPList to retrieve the settings of the document library:
$User = Get-MgUser -UserId Tony.Redmond@office365itpros.com
$OneDrive = Get-MgUserDrive -userid $User.Id | Select-Object {$_.Name -like "*OneDrive*"}
$SiteUrl = $Drive.WebUrl.Substring(0, $Drive.WebUrl.IndexOf("/Documents")+1)
Connect-PnPOnline $SiteURL -Interactive -ClientId cb5f363f-fbc0-46cb-bcfd-0933584a8c57
$LibrarySettings = Get-PnPList -Identity 'Documents'
Alas, the settings don’t include anything to enable intelligent versioning, so this experiment came to a crashing halt.
Next, I fell back on a combination of the Microsoft Graph PowerShell SDK and the SharePoint Online management module to:
- Find the set of user accounts licensed to use SharePoint Online.
- For each account, find if they have a OneDrive for Business account. The Get-SPOSite cmdlet can fetch details of either a SharePoint Online site or OneDrive for Business account.
- If an account exists, check if intelligent versioning is enabled and if not, enable it.
- Capture and report the results.
This approach worked and all the OneDrive for Business accounts in my tenant are now enabled for intelligent versioning (Figure 2). You can download the script from GitHub.
Keep PowerShell Modules Updated
After going down the rabbit hole of PnP, it was nice to find a solution with the Graph SDK and SharePoint Online PowerShell. This is no criticism of PnP. New builds of that module appear frequently, and the maintainers do an excellent job to track change within SharePoint Online and respond with cmdlet updates. Perhaps the change to deal with enabling intelligent versioning is in one of their nightly updates.
It is important to update modules on an ongoing basis. I used V2.25 of the SDK, version 16.0.25409.12000 of the SharePoint Online management module, and version 2.2.0 of the PnP.PowerShell module. Use the script described in this article to update your modules (and clear out old versions of modules).
Need more help to write PowerShell for Microsoft 365? Get a copy of the Automating Microsoft 365 with PowerShell eBook, available standalone or as part of the Office 365 for IT Pros eBook bundle.
Using the Audit Log to Generate a Daily Action Summary for a User
Analyze the Audit Events for a User Over a Single Day
I’m speaking about decoding the Microsoft 365 audit log at the ESPC conference in Stockholm, Sweden today. As part of the preparation for the session, I wanted to create a demo to highlight some of the challenges of interpreting audit records to attendees. I have many examples of PowerShell scripts that perform different tasks, like finding the last accessed date for documents stored in SharePoint Online. These scripts work well and solve problems, but they don’t shine a light onto the biggest single issue with audit log data. That issue is the maddening inconsistency found in the audit data payload contained in audit records.
The Two Parts of Audit Log Records
Audit records have two parts. The first is a consistent set of properties that must be respected by workloads when they generate audit records. These properties include the unique identity (GUID) for the record, a timestamp, the name of the user or process who performed an action, and the name of the action. The second part is the audit payload, a JSON structure contained in the AuditData property. Microsoft 365 workloads like Exchange Online and SharePoint Online control what they insert into the audit payload for their events, and no consistency and sometimes no reason governs what turns up in audit payloads.
The lack of consistency means that anyone attempting to interpret audit data must figure out what the audit payload contains and put it into context with what you know about the action captured by the event. The content differs from Exchange Online to SharePoint Online to Teams to Planner to Entra ID. The lack of consistency and the obvious errors in audit data points to poor control and attention to detail by engineering groups, both the team responsible for the audit log and the teams responsible for generating workload events.
Investigating User Actions for a Day
To illustrate the problem, I decided to create a script to report details of all actions taken by an individual user over a single day. I developed the script by fetching the audit records (about 2,200) logged for me on 27 November 2024 and reporting what I found. I stripped UserLoggedIn events from the set because of the number (946) of sign-ins to different applications from multiple devices. Most of the sign-ins are silent and result from the renewal of an access token. Figure 1 shows what the output report looks like.
The set of actions spanned interactions with multiple workloads for user activities like creating and updating documents, sending messages via Exchange and Teams, and reading a Planner task list. It also included some administrative actions like conducting an eDiscovery search, running some Exchange PowerShell cmdlets, and so on. No set of audit events for any single user will be 100% representative of what you’ll find across Microsoft 365, but I am confident that the results found in this set of audit records demonstrates the problem.
The script unpacks the audit payload for each event to extract a small set of properties for the report. A large Switch statement is used to interpret each type of event. It would be practically impossible to include every possible event, so I concentrated on common events and some that illustrate the problem.
In some cases, some of the properties contained in compliance audit records are obscured through Base64 encoding. Unfortunately, the encoding is resistant to PowerShell decoding unless you remove spurious characters at the end of the string. For example, here’s how the script handles events for the Get-ComplianceSearch action (retrieve details of a content search):
"Get-ComplianceSearch" {
$Action = 'Compliance search retrieved'
If ($AuditData.Parameters -eq '-ResultSize "Unlimited"' ) {
$Object = "All results"
} Else {
$Object = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String( $AuditData.Parameters.Split('"')[1].SubString(0,32)))
}
$Location = $AuditData.Workload
$Workload = 'eDiscovery'
}
Some audit events contain details for multiple events. This is done for very good reason as the actions being captured are very common and would otherwise flood the audit log with data. The MailItemsAccessed event is a good example. This event is now available to Purview Audit Standard (Office 365 E3) customers and captures details of email items accessed by a user. The audit payload for a MailItemsAccessed event can contain details of 20 or 30 messages. MailItemsAccessed events can also contain details of sync actions (see this article and the associated script for details).
You can download the script to generate a report of user audit events for a day from GitHub. It’s easy to add processing for other events if you wish.
Consistency Would Make Administration Easier
The bottom line is that interpreting audit events takes a lot of knowledge and persistence. Like anything else in technology, the combination brings you a long way. It’s regrettable that Microsoft has allowed a situation to develop where nearly 2,000-odd audit events might need different processing to extract real value. Life would be so much easier if audit data was more consistent.
Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.
Kemkomdigi dan Microsoft Luncurkan ElevAIte Indonesia: Bekali 1 Juta Talenta dengan Keterampilan AI
Read in English here
Kementerian Komunikasi dan Digital (Kemkomdigi) Republik Indonesia bekerja sama dengan Microsoft meluncurkan ElevAIte Indonesia, sebuah inisiatif pelatihan kecerdasan buatan (AI) untuk membekali 1 juta talenta Indonesia dengan keterampilan yang relevan di era transformasi digital. Menggabungkan makna “elevate” (meningkatkan) dengan “AI”, program ini menjadi simbol kolaborasi multi-sektor untuk memperkuat posisi Indonesia di kancah global melalui pemanfaatan teknologi AI.
ElevAIte Indonesia akan melibatkan mitra dari pemerintahan, industri, institusi pendidikan, dan komunitas. Program ini dirancang untuk menghubungkan talenta Indonesia dengan peluang baru yang tercipta dari teknologi AI, seperti peningkatan produktivitas, kreativitas, dan kualitas pekerjaan, serta percepatan inovasi yang bertanggung jawab.
Menteri Komunikasi dan Digital, Meutya Hafid, menekankan pentingnya pendekatan yang bijak dalam pemanfaatan teknologi, khususnya AI, yang semakin memengaruhi berbagai aspek kehidupan. “Teknologi modern, seperti AI, menuntut kita semua, khususnya para pemimpin, untuk menjadi lebih bijak, sabar, dan akomodatif. Perkembangan AI memberikan peluang besar untuk meningkatkan kualitas hidup, tetapi juga membawa tantangan yang harus dikelola dengan hati-hati,” ujar Meutya.
Lebih lanjut, Menkomdigi menjelaskan bahwa kolaborasi, komunikasi, dan negosiasi adalah kunci untuk memastikan teknologi dapat dimanfaatkan secara maksimal dan bertanggung jawab. “Pemanfaatan AI tidak bisa dilakukan secara sepihak. Kita memerlukan sinergi dengan berbagai pihak, mulai dari pemerintah, pelaku industri, hingga masyarakat. Melalui inisiatif seperti ElevAIte Indonesia, kami ingin menunjukkan bagaimana teknologi AI dapat digunakan untuk memperkuat ekosistem nasional sambil tetap menjaga nilai-nilai etika dan kepentingan bersama,” tambah Meutya.
Program ElevAIte Indonesia menjadi salah satu contoh nyata dari pendekatan kolaboratif tersebut. Dengan melibatkan mitra ekosistem yang luas, inisiatif ini dirancang untuk membekali generasi muda dan tenaga kerja dengan keterampilan AI yang sesuai dengan kebutuhan industri dan masyarakat. Selain meningkatkan kapasitas sumber daya manusia, program ini juga menjadi landasan bagi Indonesia untuk bersaing di tingkat global dan menuju cita-cita Indonesia Emas 2045.
Inisiatif ElevAIte Indonesia menjadi semakin penting mengingat meningkatnya kebutuhan keterampilan AI dalam dunia kerja. Menurut laporan Work Trend Index yang Microsoft dan LinkedIn keluarkan di awal tahun 2024, 69% pemimpin di Indonesia menyatakan bahwa mereka tidak akan merekrut seseorang tanpa keterampilan AI. Sebanyak 76% bahkan cenderung merekrut kandidat dengan pengalaman kerja yang lebih sedikit namun handal menggunakan AI, dibandingkan kandidat berpengalaman tanpa kemampuan AI.
“Dengan sekitar 70% penduduk Indonesia berada dalam usia produktif, membekali mereka dengan keterampilan AI yang tepat menjadi kian penting. Sebab, kita sebagai talenta Indonesia lah yang akan mampu membawa Indonesia melaju, menuju Indonesia Emas 2045. Untuk itu, ElevAIte Indonesia akan berfokus pada pembekalan keterampilan mengadopsi AI secara bertanggung jawab. Mulai dari menggunakan tools AI agar dapat menyelesaikan pekerjaan dengan lebih cepat dan dengan kualitas yang lebih baik, hingga mengembangkan solusi AI untuk menciptakan nilai tambah dan menjawab permasalahan nasional yang paling mendesak. Penting untuk diingat bahwa transformasi AI bukan hanya transformasi teknologi, melainkan transformasi nasional. Kami merasa terhormat dapat bermitra dengan Kemkomdigi dan segenap ekosistem nasional untuk memberdayakan talenta Indonesia,” ujar Dharma Simorangkir, Presiden Direktur Microsoft Indonesia.
Guna mencapai target 1 juta pembekalan keterampilan AI bagi masyarakat Indonesia hingga tahun 2025 mendatang, implementasi ElevAIte Indonesia akan terbagi ke dalam lima pilar utama, dengan Biji-Biji Initiative dan Dicoding sebagai mitra pelatihan. Kelima pilar tersebut:
- Menyiapkan lembaga pemerintah untuk mendorong kecakapan AI nasional. Pilar ini berfokus pada pemberian pelatihan keterampilan AI bagi aparatur sipil negara, penguatan kapabilitas keamanan siber di lembaga pemerintahan, dan inisiasi pelayanan publik berbasis AI.
- Integrasi AI di industri strategis nasional. Pilar ini berfokus pada percepatan transformasi AI bagi pelaku industri Indonesia, mulai dari UMKM hingga enterprise, guna meningkatkan inovasi dan menciptakan nilai ekonomi AI baru.
- Keterampilan AI dalam dunia pendidikan. Pilar ini berfokus pada revolusi pembelajaran dalam berbagai sistem pendidikan di Indonesia, pembekalan keterampilan AI bagi pendidik, dan pengembangan generasi developer baru di Indonesia. Indonesia sendiri memiliki jumlah developer yang signifikan. Laporan GitHub menunjukkan bahwa Indonesia merupakan rumah terbesar ketiga bagi komunitas developerGitHub di di kawasan Asia Pasifik, setelah India dan Tiongkok. Indonesia pun diproyeksikan menjadi salah satu dari lima komunitas developer terbesar di GitHub secara global pada tahun 2026. Tidak hanya itu, Indonesia juga merupakan salah satu kelompok dengan pertumbuhan developer tercepat di Asia Pasifik, dengan peningkatan jumlah developer di GitHub mencapai 31 persen dari tahun ke tahun (year-on-year) pada tahun 2023.
- Peningkatan keterampilan AI bagi komunitas: Pilar ini berfokus pada pemberian keterampilan AI bagi kelompok masyarakat yang kurang terlayani, kurang terwakili, dan termarginalkan secara digital. Termasuk di antaranya adalah perempuan, penyandang disabilitas, dan masyarakat yang berada di daerah-daerah terpencil. NUCare Global dan Microsoft Innovative Educator Expert merupakan mitra program ini, dengan lebih banyak mitra akan diumumkan secara terpisah.
- Demokratisasi AI bagi setiap individu: Pilar ini hendak memastikan setiap individu memiliki kesempatan yang sama untuk belajar AI. Untuk itu, sebagai bagian dari ElevAIte Indonesia, Microsoft telah meluncurkan AI Skills Navigator, sebuah platform yang menyatukan seluruh konten pembelajaran dari Microsoft Learn dan LinkedIn Learning. Dibekali dengan asisten AI dan dapat diakses melalui microsoft.com, platform ini dapat mempermudah individu menemukan materi pembelajaran AI yang sesuai dengan tujuan, minat, dan gaya belajar masing-masing. Versi Bahasa Indonesia dari platform ini akan tersedia dalam waktu dekat.
Rashvin Pal Singh, Group CEO Biji-biji Initiative mengatakan, “Selama dua tahun terakhir, kami telah banyak bekerja sama dengan Kemkomdigi dan Microsoft untuk menyelenggarakan program-program keterampilan AI. Dari program-program tersebut, kami sudah melihat langsung bagaimana sebagian peserta dapat memperoleh pekerjaan yang lebih baik, ataupun memiliki kehidupan yang lebih sejahtera. Kini, dengan adanya ElevAIte Indonesia, kami berharap dapat semakin memperluas kesuksesan yang ada, dengan pendekatan yang kian terintegrasi dan terukur.”
Narenda Wicaksono, Chief Executive Officer, Dicoding mengatakan, “Sebagai platform edukasi teknologi, kami sadar bagaimana kapabilitas baru AI telah menjadi terobosan teknologi terbesar dalam beberapa tahun terakhir. Kami sendiri telah menggunakan AI untuk melayani lebih dari 1 juta member dicoding. Kami percaya bahwa dengan keterampilan AI yang tepat, individu dan organisasi dapat menciptakan solusi inovatif yang berdampak positif bagi masyarakat, industri, maupun negara. Itulah sebabnya, kami senang dapat bergabung dengan Kemkomdigi, Microsoft, dan segenap ekosistem digital Indonesia lainnya di inisiatif ElevAIte Indonesia.”
Menkomdigi mengakhiri dengan mengutip Presiden Prabowo Subianto saat Pertemuan APEC 2024 di Peru, yang menekankan pentingnya keseimbangan dalam memanfaatkan teknologi: “Kemajuan besar dalam teknologi menuntut para pemimpin untuk lebih bijaksana, sabar, dan akomodatif. Teknologi memiliki kekuatan untuk membawa kemajuan luar biasa, tetapi juga dapat menghancurkan kehidupan manusia dengan sangat cepat. Oleh karena itu, kolaborasi, komunikasi, dan negosiasi adalah jalan terbaik. Kita harus menaati hukum dan aturan internasional, namun juga memahami kepentingan bersama.”
Dengan semangat tersebut, ElevAIte Indonesia diharapkan dapat menjadi langkah strategis dalam membangun ekosistem digital yang inklusif dan memberdayakan.
###
