Hello Community,

I’ve been encountering a challenging issue with implementing a Conditional Access (CA) policy to block downloads on unmanaged devices and could really use some insights.

Here’s the situation:

Objective: Block downloads for unmanaged devices using Conditional Access.Setup: I’ve replicated the policy setup across two tenants, ensuring that licenses and CA policies are identical.

Problem:

In one tenant, the policy works flawlessly.In the other tenant, users experience a timeout on the “Access to Microsoft SharePoint Online is monitored” screen. After this timeout, they are given the option to bypass Defender for Cloud Apps, which is not the desired outcome.

I’ve tried the following troubleshooting steps:

Removed all conditions to isolate the issue—no success.Ensured that the test user has no roles associated.

Despite these efforts, I’m still unable to get the policy to work correctly in the problematic tenant. The timeout and bypass options are a major concern, as they defeat the purpose of the policy.

Has anyone encountered this issue before, or does anyone have suggestions for resolving this?

Thanks in advance for your help!

​Hello Community,I’ve been encountering a challenging issue with implementing a Conditional Access (CA) policy to block downloads on unmanaged devices and could really use some insights.Here’s the situation:Objective: Block downloads for unmanaged devices using Conditional Access.Setup: I’ve replicated the policy setup across two tenants, ensuring that licenses and CA policies are identical.Problem:In one tenant, the policy works flawlessly.In the other tenant, users experience a timeout on the “Access to Microsoft SharePoint Online is monitored” screen. After this timeout, they are given the option to bypass Defender for Cloud Apps, which is not the desired outcome.I’ve tried the following troubleshooting steps:Removed all conditions to isolate the issue—no success.Ensured that the test user has no roles associated.Despite these efforts, I’m still unable to get the policy to work correctly in the problematic tenant. The timeout and bypass options are a major concern, as they defeat the purpose of the policy.Has anyone encountered this issue before, or does anyone have suggestions for resolving this?Thanks in advance for your help!   Read More

​

Hello guys,

Since today afternoon 29/08/2024 i have some issues with Teams left toolbar.

This is how it appear

And these are my configuration settings set by policy

As u can see my menu it’s completely messed up, and until yesterday night was ok… now i have tried to modify and apply config but nothing changes… 

Any idea?

​Hello guys,Since today afternoon 29/08/2024 i have some issues with Teams left toolbar. This is how it appearAnd these are my configuration settings set by policyAs u can see my menu it’s completely messed up, and until yesterday night was ok… now i have tried to modify and apply config but nothing changes… Any idea?VersioneHai la versione di Microsoft Teams 24215.1007.3082.1590.È stata ricevuta la versione più recente. È stato controllato l’ultima volta in data 29/08/2024.La versione client è 49/24080212008.Accesso in anteprima  Read More

​

The Planner team is excited to share some fresh new updates in the Planner app for Microsoft Teams. We thank you for your valuable feedback that helps shape feature updates, and hope these capabilities significantly enhance your experience managing tasks and coordinating team initiatives.

Resize columns in Grid view

Customize your task view by resizing columns, making it easier to focus on what’s important. Try it out by navigating to Grid view in My Day, My Tasks, or any plan and hovering over any column to increase or decrease its width.

Discover Recommended Plans

We’re excited to introduce the Recommended Plans feature in the new Planner in Teams. This feature helps you quickly find relevant plans for your work by highlighting any new plans with tasks assigned to you that you haven’t yet viewed.

You’ll find the Recommended Plans view in My Plans, alongside other views like Recent, Shared, Private, and Pinned. Remember, the Recommended Plans view will only appear if there are new plans with tasks assigned to you that haven’t already been listed under Recent Plans.

An improved experience for copying plan links

Copying the link to a plan now pastes the link with the plan’s name, making it easier for you and your teammates to identify the linked plan. Select ‘Copy link to plan’ from the overflow menu of any plan and paste the link to check out this capability.

Use Copilot in Planner (preview)

While final pricing has not been announced, users with a Project Plan 3 or Project Plan 5 license can preview Copilot in Planner capabilities. Copilot in Planner (preview) can supercharge your project planning, task managing, and progress tracking processes. For more information on Copilot in Planner (preview), see: Try out the new Copilot in Planner (preview) today in the new Microsoft Planner in Teams – Microsoft Community Hub.

If you’d like to try this feature but don’t have a Project license, you can start a free 30-day trial of a Project Plan 3 license by selecting the diamond icon within the Planner app in Teams.

Access Planner in GCC

Government Community Cloud (GCC) users can now access the Planner app in Teams, ensuring secure and efficient task management. To learn more about this update, check out: The new Microsoft Planner in Teams is now available in GCC – Microsoft Community Hub.

Open premium plans faster

We’ve recently made several changes so you can open your premium plans 15% faster than before. We know that app performance is important to complete your work successfully and this is one of many enhancements we plan to make in this area. Try it out and let us know if you can feel the difference!

Share your feedback

Your feedback helps inform our feature updates and we look forward to hearing from you as you try out Planner’s new and existing capabilities! To share your feedback about the new Planner app in Teams, including bugs you’ve observed in our product, you can navigate to the ? icon in the Planner app and select ‘Feedback’ as seen in the GIF below. We also encourage you to share any features you would like to see in the app by adding it to our Planner Feedback Portal.

Learn more about the new Planner

Register now for our 9/17 inside look at the new Planner  The new Microsoft Planner: What’s New and What’s Coming Next and AMA  
Watch our first Meet the Makers and AMA
Watch the new Planner demos for inspiration on how to get the most out of the new Planner app in Microsoft Tea…
Read about our investments for organizations using the new Planner with frontline workers.
Try out the new Copilot in Planner (preview) today in the new Microsoft Planner in Teams
Check out the new Planner adoption website and explore new resources such as Day in the Life Guides to use Planner for task management, collaborative work management and project management.
We’ve got a lot more ‘planned’ for the new Planner this year! Stay tuned to the Planner Blog – Microsoft Community Hub for news.
For future updates coming to the new Planner app, please view the Microsoft 365 roadmap here.
Learn about Planner and Project plans and pricing here.
Read the FAQs here.

​Microsoft Tech Community – Latest Blogs –Read More 

1. Challenge

In Azure Landing Zones, the network infrastructure, including components like VNET Gateways and ExpressRoute circuits, is part of the platform landing zone. However, in line with the subscription democratization principle, workload owners should be empowered to deploy infrastructure as needed while remaining compliant with corporate policies.

To achieve this in Azure Landing Zones, a custom Subscription Owner role grants workload (VNET) owners full access, excluding role assignments and networking. While this setup generally works, it poses a challenge for Private Endpoints. Registering a Private Endpoint into the required Private DNS Zone, which is centrally managed in the platform landing zone, is not possible because workload subscription owners lack access to these Private DNS Zones. Although they can be granted access using the Private DNS Zone Contributor role, assigned to the “connectivity” subscriptions or management groups, this role provides too much access, such as editing or deleting records. Ideally, only the (de-)registration of the CNAME record for the Private Endpoint should be allowed. This article describes a simple solution to this problem while ensuring compliance with Azure Landing Zone policies.

MS Learn outlines an approach for “Private Link and DNS integration at scale”, but it has several drawbacks:

The policies can quickly become large and complex.
Each Private Link Resource type requires dedicated code in the policy.
This method is incompatible with several resource types such as AKS and PostgreSQL Flexible Server.

The approach described in this article is easy to deploy and provides a seamless, Azure Landing Zones-compliant solution.

2. AZURE Landing Zones

The diagram below shows the resource structure in an AZURE Landing Zone. A subscription in the “Landing Zones” management group serves as boundary for a single workload. The owners of the workload are assigned the “Subscription Owner” role on the subscription. The Private DNS Zones however, reside in the “Connectivity” subscription, part of the “Platform” management group. 

Deploying a Private Endpoint in the workload subscription requires creating a CNAME record in the correct Private DNS Zone (in the platform landing zone), not accessible by “Subscription Owners”.

3. Role Based Access Control

To register a Private Endpoint’s CNAME record, the identity (user, service principal, or managed identity) must have the “Microsoft.Network/privateDnsZones/join/action” permission on the Private DNS Zone. While this is the only essential action, for a seamless experience across PowerShell, CLI, and the portal, at least two additional actions are necessary: 

Microsoft.Resources/subscriptions/resourceGroups/read: This allows browsing the resource groups in the portal, with no access to the resources in the group. The portal requires this to allow browsing to the Private DNS Zone.

Optionally you can add Microsoft.Network/privateDnsZones/*/read: This allows reading the records in Private DNS Zone. It’s not a must, but allows validating presence of the CNAME records.

4. Custom Role

The simplest and recommended way to assign rights for a specific set of actions to an identity is through a custom role. Note that this requires an Entra ID P2 license, which is also necessary for the Azure Landing Zone (ALZ) recommended custom roles. The Bicep code below lists the role definition and facilitates easy deployment of the role into the landing zone environment:

targetScope = ‘managementGroup’

metadata name = ‘PrivateEndpointDnsContributor Role’
metadata description = ‘Role for registring a Prviate Endpoint in a Private DNS Zone’

var varRole = {
name: ‘[${managementGroup().name}] PrivateEndpointDnsContributor’
description: ‘Role for Contributing to Private Endpoint DNS Configuration’
}

resource resRoleDefinition ‘Microsoft.Authorization/roleDefinitions@2022-04-01’ = {
name: guid(varRole.name, managementGroup().name)
properties: {
roleName: varRole.name
description: varRole.description
type: ‘CustomRole’
permissions: [
{
actions: [
‘Microsoft.Resources/subscriptions/resourceGroups/read’
‘Microsoft.Network/privateDnsZones/read’
‘Microsoft.Network/privateDnsZones/*/read’
‘Microsoft.Network/privateDnsZones/join/action’
]
notActions: []
dataActions: []
notDataActions: []
}
]
assignableScopes: [
tenantResourceId(‘Microsoft.Management/managementGroups’, managementGroup().name)
]
}
}

output outRoleDefinitionId string = resRoleDefinition.id

This BICEP template has to be deployed into the “Intermediate Root ” management group (“Contoso” in the diagram in the previous paragraph). Below you find a PowerShell snippet showing how to deploy the bicep code:

Connect-AzAccount

$inputObject = @{
DeploymentName = ‘PrivateEndpointDnsContributor-{0}’ -f (-join (Get-Date -Format ‘yyyyMMddTHHMMssffffZ’)[0..63])
Location = “eastus”
ManagementGroupId = “contoso”
TemplateFile = “./PrivateEndpointDnsContributor.bicep”
}

New-AzManagementGroupDeployment @inputObject

5. Role assignments

​Microsoft Tech Community – Latest Blogs –Read More 

Hello everybody,

the site share settings are set to “site owners and members… People with Edit permissions can share files and folders.”

We introduced several SharePoint Groups with the Permission level “Edit without delete” which is just a copy of permission level edit without delete items and delete versions.

Users which are members of theses Sharepoint Groups can add folders, files to the Sharepoint document library. But if they try to share a file they get  the message as soon as they enter a name

The person the share is addressed to is member of one of the sharepoint groups as well.

My question: Why can’t people with apparent edit permission share a file. This is a contradiction to the setting people with edit permission can share … and the user’s ability to add folders and files.

We use Sharepoint online. 

I think this behaviour is some sort of bug.

This really causes us quite a bit of strain.

Any advice/help is very welcomed.

Kind regards

​Hello everybody, the site share settings are set to “site owners and members… People with Edit permissions can share files and folders.”We introduced several SharePoint Groups with the Permission level “Edit without delete” which is just a copy of permission level edit without delete items and delete versions. Users which are members of theses Sharepoint Groups can add folders, files to the Sharepoint document library. But if they try to share a file they get  the message as soon as they enter a nameThe person the share is addressed to is member of one of the sharepoint groups as well. My question: Why can’t people with apparent edit permission share a file. This is a contradiction to the setting people with edit permission can share … and the user’s ability to add folders and files. We use Sharepoint online.  I think this behaviour is some sort of bug. This really causes us quite a bit of strain. Any advice/help is very welcomed. Kind regards     Read More

​

Hi there,

I am trying to do a formula based on a tiered system. So an employee gets paid out per deal based on how many deals they get. See example below. So for February they would get paid out $300*4=$1,200 based on hitting tier 2 for 3 or more deals but less than tier 3 for DCI Deals and $400*10=$4,000 for Certainli Deals for hitting tier 3, 10 deals or higher giving them a total of $5,200 bonus that month. Any help is appreciated, thank you so much!!

 Tier 1Tier 2Tier 3DCI $      150.00 $      300.00 $      600.00Certainli  $      100.00 $      200.00 $      400.00 Tier 1Tier 2Tier 3DCI036Certainli0510 JanuaryFebruaryMarchAprilMayJuneJulyAugustDCI Deals34642313Certainli Deals510523521

​Hi there,I am trying to do a formula based on a tiered system. So an employee gets paid out per deal based on how many deals they get. See example below. So for February they would get paid out $300*4=$1,200 based on hitting tier 2 for 3 or more deals but less than tier 3 for DCI Deals and $400*10=$4,000 for Certainli Deals for hitting tier 3, 10 deals or higher giving them a total of $5,200 bonus that month. Any help is appreciated, thank you so much!! Tier 1Tier 2Tier 3DCI $      150.00 $      300.00 $      600.00Certainli  $      100.00 $      200.00 $      400.00 Tier 1Tier 2Tier 3DCI036Certainli0510 JanuaryFebruaryMarchAprilMayJuneJulyAugustDCI Deals34642313Certainli Deals510523521  Read More

​

I have a vmware Virtual Windows 2008 r2 standard server and the NIC does not show update on the OS.  Also the Device Manager is blank.

​I have a vmware Virtual Windows 2008 r2 standard server and the NIC does not show update on the OS.  Also the Device Manager is blank.  Read More

​

Hello Guys, 

I hope you all are doing well. I already posted this as question but i wanted to start discussion since perhaps some of you maybe had better experience.

I want to integrate CloudWatch logs to S3 bucket using Lambda function and then to send those logs to Microsoft Sentinel.

As per Microsoft documentation provided: Ingest CloudWatch logs to Microsoft Sentinel – create a Lambda function to send CloudWatch events to S3 bucket | Microsoft Learn

Connect Microsoft Sentinel to Amazon Web Services to ingest AWS service log data | Microsoft Learn

there is a way to do this BUT, first link is from last year and when i try to ingest logs on way provided there is always an error in query “Unable to import module ‘lambda_function’: No module named ‘pandas’ ; Also, as i understood, Lambda Python script gives you the specified time range you need to set in order to export those logs – i want that logs be exported every day each few minutes and synchronized into Microsoft Sentinel.

(Lambda function .py script was run in Python 3.9 as mentioned on Microsoft documentation, also all of the resources used were from github solution mentioned in Microsoft documents).

When trying to run automation script provided i got created S3 bucket IAM role and SQS in AWS which is fine, but even then, the connector on AWS is still grey without any changes.

I even tried to change IAM role in AWS by adding Lambda permissions and using it for Lambda queries i found on internet, created CloudWatch event bridge rule for it, but even though i can see some of .gz data ingested to S3 bucket, there is no data sent to Microsoft Sentinel.

So is there anyone here that can describe full process needed to be preformed in order to ingest logs from CloudWatch to Sentinel successfully and maybe are there some people that had experience with this process – what are the things i need to take care of / maybe log ingestion data (to be cost effective) etc..

I want to mention that i am preforming this in my testing environment.

Since automation script in powershell gives you capability to automatically create aws resources necessary, i tried this on test environment:

Downloaded AWS CLI, ran aws config, provided keys necessary with default location of my resources.

2.Run Automation Script from powershell as documentation mentioned, filled out all fields necessary.

2.1 Automation script created:

2.1.1 S3 Bucket with Access policy:

allow IAM role to read S3 bucket and s3GetObject from s3 bucketAllow CloudWatch to upload objects to bucket with S3PutObject, AWS Cloud Watch ACLCheck Allowed from CloudWatch to S3 bucket.

2.1.2 Notification event for S3 bucket to send all logs from specified S3 bucket to SQS for objects with suffix .gz (Later edited this manually and added all event types to make sure events are sent)

2.1.3 SQS Queue with Access Policy – Allow S3 bucket to SendMessage to SQS service.

2.1.4 IAM user with Sentinel Workspace ID and Sentinel RoleID

Since this was deployed via Automation script, in order to send logs with CloudWatch it is necessary to configure Lambda function. Since script itself does not create these resources i have created it manually:

Added IAM role assignments for Permission policies:S3 Full Access, AWS Lambda Execute, CloudWatchFullAccess, CloudWatchLogsFullAccess (even later i added: CloudWatchFullAccessV2, S3ObjectLambdaExecutionRolePolicy to try it out)

1.2 Added lambda.amazonaws.com in trust relationship policy so i can use this role for Lambda execution.

Created a CloudWatch log group and log stream – created log group per subscription filter for lambda function

3.Created Lambda function as per Microsoft documentation – tried newest article
https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/enhance-the-ingestion-of-aws-cloudwatch-logs-into-microsoft/ba-p/4100565
(Choose Lambda Python 3.12 , used existing role created above);
(Took CloudWatchLambdaFunction_V2.py and there is an issue with pandas module, i managed to overcome this using the document:
https://medium.com/@shandilya90apoorva/aws-cloud-pipeline-step-by-step-guide-241aaf059918

but even then i get error:

Response {   “errorMessage”: “Unable to import module ‘lambda_function’: Error importing numpy: you should not try to import numpy fromn        its source directory; please exit the numpy source tree, and relaunchn        your python interpreter from there.”,   “errorType”: “Runtime.ImportModuleError”,   “requestId”: “”,   “stackTrace”: [] }

Anyway this is what i tried and i eventually get to same error regarding lambda function provided from Microsoft.

​Hello Guys,  I hope you all are doing well. I already posted this as question but i wanted to start discussion since perhaps some of you maybe had better experience.I want to integrate CloudWatch logs to S3 bucket using Lambda function and then to send those logs to Microsoft Sentinel.As per Microsoft documentation provided: Ingest CloudWatch logs to Microsoft Sentinel – create a Lambda function to send CloudWatch events to S3 bucket | Microsoft LearnConnect Microsoft Sentinel to Amazon Web Services to ingest AWS service log data | Microsoft Learnthere is a way to do this BUT, first link is from last year and when i try to ingest logs on way provided there is always an error in query “Unable to import module ‘lambda_function’: No module named ‘pandas’ ; Also, as i understood, Lambda Python script gives you the specified time range you need to set in order to export those logs – i want that logs be exported every day each few minutes and synchronized into Microsoft Sentinel.(Lambda function .py script was run in Python 3.9 as mentioned on Microsoft documentation, also all of the resources used were from github solution mentioned in Microsoft documents).When trying to run automation script provided i got created S3 bucket IAM role and SQS in AWS which is fine, but even then, the connector on AWS is still grey without any changes.I even tried to change IAM role in AWS by adding Lambda permissions and using it for Lambda queries i found on internet, created CloudWatch event bridge rule for it, but even though i can see some of .gz data ingested to S3 bucket, there is no data sent to Microsoft Sentinel.So is there anyone here that can describe full process needed to be preformed in order to ingest logs from CloudWatch to Sentinel successfully and maybe are there some people that had experience with this process – what are the things i need to take care of / maybe log ingestion data (to be cost effective) etc..I want to mention that i am preforming this in my testing environment.Since automation script in powershell gives you capability to automatically create aws resources necessary, i tried this on test environment:Downloaded AWS CLI, ran aws config, provided keys necessary with default location of my resources.2.Run Automation Script from powershell as documentation mentioned, filled out all fields necessary.2.1 Automation script created:2.1.1 S3 Bucket with Access policy:allow IAM role to read S3 bucket and s3GetObject from s3 bucketAllow CloudWatch to upload objects to bucket with S3PutObject, AWS Cloud Watch ACLCheck Allowed from CloudWatch to S3 bucket.2.1.2 Notification event for S3 bucket to send all logs from specified S3 bucket to SQS for objects with suffix .gz (Later edited this manually and added all event types to make sure events are sent)2.1.3 SQS Queue with Access Policy – Allow S3 bucket to SendMessage to SQS service.2.1.4 IAM user with Sentinel Workspace ID and Sentinel RoleIDSince this was deployed via Automation script, in order to send logs with CloudWatch it is necessary to configure Lambda function. Since script itself does not create these resources i have created it manually:Added IAM role assignments for Permission policies:S3 Full Access, AWS Lambda Execute, CloudWatchFullAccess, CloudWatchLogsFullAccess (even later i added: CloudWatchFullAccessV2, S3ObjectLambdaExecutionRolePolicy to try it out)1.2 Added lambda.amazonaws.com in trust relationship policy so i can use this role for Lambda execution.Created a CloudWatch log group and log stream – created log group per subscription filter for lambda function3.Created Lambda function as per Microsoft documentation – tried newest articlehttps://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/enhance-the-ingestion-of-aws-cloudwatch-logs-into-microsoft/ba-p/4100565(Choose Lambda Python 3.12 , used existing role created above);(Took CloudWatchLambdaFunction_V2.py and there is an issue with pandas module, i managed to overcome this using the document:https://medium.com/@shandilya90apoorva/aws-cloud-pipeline-step-by-step-guide-241aaf059918but even then i get error:Response {   “errorMessage”: “Unable to import module ‘lambda_function’: Error importing numpy: you should not try to import numpy fromn        its source directory; please exit the numpy source tree, and relaunchn        your python interpreter from there.”,   “errorType”: “Runtime.ImportModuleError”,   “requestId”: “”,   “stackTrace”: [] }Anyway this is what i tried and i eventually get to same error regarding lambda function provided from Microsoft.  Read More

​