The following code works fine on a small Range..

But when i expand the Range for the whole worksheet..it  runs very very  slow

Private Sub Worksheet_SelectionChange(ByVal Target As Range)
Dim x As Range
For Each x In Range(“B4:BI84”)
With x.Validation
.Delete
.Add Type:=xlValidateInputOnly, AlertStyle:=xlValidAlertStop, _
Operator:=xlBetween
.IgnoreBlank = True
.InCellDropdown = True
.InputMessage = Target.Value ””First Name of Sales Rep”
.ShowError = True
End With
Next x

End Sub

​The following code works fine on a small Range..But when i expand the Range for the whole worksheet..it  runs very very  slow Private Sub Worksheet_SelectionChange(ByVal Target As Range)Dim x As RangeFor Each x In Range(“B4:BI84″)With x.Validation.Delete.Add Type:=xlValidateInputOnly, AlertStyle:=xlValidAlertStop, _Operator:=xlBetween.IgnoreBlank = True.InCellDropdown = True.InputMessage = Target.Value ””First Name of Sales Rep”.ShowError = TrueEnd WithNext xEnd Sub  Read More

​

Hi, we are having a few issues with the Sentinel templated analytic rule – MFA Rejected by User (version 2.0.3) – https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Entra%20ID/Analytic%20Rules/MFARejectedbyUser.yaml

Over the last 30 days this analytic rule has generated 98 incidents which are all false positives.

The analytic rule works on looking at Entra ID signinlogs against result type 500121 with one or more of the following additional details reported “MFA denied; user declined the authentication” or “fraud”.

It maps UEBA identity information then join the behavior analytics data summarised by IP Address. It’s the summarising of the IP address data which has me questioning the code.

When we get an event in the signin logs it also generates an event in the UEBA behavior analytic table along with a IP investigation score. If you have multiple events in the time period of the rules query period then the summarizing does a SUM() against the IP investigation data which can turn into a high which breaches the threshold.

The default threshold is 20 but I have seen IP investigation scores summed again being between 60 and 100+ but the individual event record for the MFA rejection gives a score of 3 or 4.

Anyone an expert with UEBA and KQL be able to tell me if the original code looks ok? – https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Entra%20ID/Analytic%20Rules/MFARejectedbyUser.yaml 

Would to be better served by the following code?

let riskScoreCutoff = 20; //Adjust this based on volume of results
SigninLogs
| where ResultType == 500121
| extend additionalDetails_ = tostring(Status.additionalDetails)
| extend UserPrincipalName = tolower(UserPrincipalName)
| where additionalDetails_ =~ “MFA denied; user declined the authentication” or additionalDetails_ has “fraud”
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), UserId = any(UserId), AADTenantId=any(AADTenantId), DeviceName=any(DeviceDetail.displayName), IsManaged=any(DeviceDetail.isManaged), OS = any(DeviceDetail.operatingSystem) by UserPrincipalName, IPAddress, AppDisplayName
| extend Name = tostring(split(UserPrincipalName,’@’,0)[0]), UPNSuffix = tostring(split(UserPrincipalName,’@’,1)[0])
| join kind=leftouter (
IdentityInfo
| summarize LatestReportTime = arg_max(TimeGenerated, *) by AccountUPN
| project AccountUPN, Tags, JobTitle, GroupMembership, AssignedRoles, UserType, IsAccountEnabled
| summarize
Tags = make_set(Tags, 1000),
GroupMembership = make_set(GroupMembership, 1000),
AssignedRoles = make_set(AssignedRoles, 1000),
UserType = make_set(UserType, 1000),
UserAccountControl = make_set(UserType, 1000)
by AccountUPN
| extend UserPrincipalName=tolower(AccountUPN)
) on UserPrincipalName
| join kind=leftouter (
BehaviorAnalytics
| where ActivityType in (“FailedLogOn”, “LogOn”)
| where isnotempty(SourceIPAddress)
| project UsersInsights, DevicesInsights, ActivityInsights, InvestigationPriority, SourceIPAddress
| project-rename IPAddress = SourceIPAddress
| summarize
UsersInsights = make_set(UsersInsights, 1000),
DevicesInsights = make_set(DevicesInsights, 1000)
//IPInvestigationPriority = tostring(InvestigationPriority)
by IPAddress, IPInvestigationPriority=InvestigationPriority)
on IPAddress
| extend UEBARiskScore = IPInvestigationPriority
| where UEBARiskScore > riskScoreCutoff
| sort by UEBARiskScore desc

​Hi, we are having a few issues with the Sentinel templated analytic rule – MFA Rejected by User (version 2.0.3) – https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Entra%20ID/Analytic%20Rules/MFARejectedbyUser.yaml Over the last 30 days this analytic rule has generated 98 incidents which are all false positives. The analytic rule works on looking at Entra ID signinlogs against result type 500121 with one or more of the following additional details reported “MFA denied; user declined the authentication” or “fraud”. It maps UEBA identity information then join the behavior analytics data summarised by IP Address. It’s the summarising of the IP address data which has me questioning the code. When we get an event in the signin logs it also generates an event in the UEBA behavior analytic table along with a IP investigation score. If you have multiple events in the time period of the rules query period then the summarizing does a SUM() against the IP investigation data which can turn into a high which breaches the threshold. The default threshold is 20 but I have seen IP investigation scores summed again being between 60 and 100+ but the individual event record for the MFA rejection gives a score of 3 or 4. Anyone an expert with UEBA and KQL be able to tell me if the original code looks ok? – https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Entra%20ID/Analytic%20Rules/MFARejectedbyUser.yaml  Would to be better served by the following code? let riskScoreCutoff = 20; //Adjust this based on volume of resultsSigninLogs| where ResultType == 500121| extend additionalDetails_ = tostring(Status.additionalDetails)| extend UserPrincipalName = tolower(UserPrincipalName)| where additionalDetails_ =~ “MFA denied; user declined the authentication” or additionalDetails_ has “fraud”| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), UserId = any(UserId), AADTenantId=any(AADTenantId), DeviceName=any(DeviceDetail.displayName), IsManaged=any(DeviceDetail.isManaged), OS = any(DeviceDetail.operatingSystem) by UserPrincipalName, IPAddress, AppDisplayName| extend Name = tostring(split(UserPrincipalName,’@’,0)[0]), UPNSuffix = tostring(split(UserPrincipalName,’@’,1)[0])| join kind=leftouter (IdentityInfo| summarize LatestReportTime = arg_max(TimeGenerated, *) by AccountUPN| project AccountUPN, Tags, JobTitle, GroupMembership, AssignedRoles, UserType, IsAccountEnabled| summarizeTags = make_set(Tags, 1000),GroupMembership = make_set(GroupMembership, 1000),AssignedRoles = make_set(AssignedRoles, 1000),UserType = make_set(UserType, 1000),UserAccountControl = make_set(UserType, 1000)by AccountUPN| extend UserPrincipalName=tolower(AccountUPN)) on UserPrincipalName| join kind=leftouter (BehaviorAnalytics| where ActivityType in (“FailedLogOn”, “LogOn”)| where isnotempty(SourceIPAddress)| project UsersInsights, DevicesInsights, ActivityInsights, InvestigationPriority, SourceIPAddress| project-rename IPAddress = SourceIPAddress| summarizeUsersInsights = make_set(UsersInsights, 1000),DevicesInsights = make_set(DevicesInsights, 1000)//IPInvestigationPriority = tostring(InvestigationPriority)by IPAddress, IPInvestigationPriority=InvestigationPriority)on IPAddress| extend UEBARiskScore = IPInvestigationPriority| where UEBARiskScore > riskScoreCutoff| sort by UEBARiskScore desc    Read More

​

Hi,

Referring to this announcement MC882258 in message center, MS informed that web content plug-in management will be removed from M365 admin center, rather it will be managed as part of Optional Connected Experience for M365.

We have currently disabled this web content plug-in in our environment but allowed Optional Connected Exp for the users. After this announced change, how web content plug-in will behave? Will it enabled because we have Optional connected exp. enabled? Secondly, what is the reason behind this change? Why MS has taken individual control setting away and mixed it with so many optional connected exp. where we do not have an option to choose which optional connected exp. we want to enable/disable. Its like all or nothing.

​Hi,Referring to this announcement MC882258 in message center, MS informed that web content plug-in management will be removed from M365 admin center, rather it will be managed as part of Optional Connected Experience for M365.We have currently disabled this web content plug-in in our environment but allowed Optional Connected Exp for the users. After this announced change, how web content plug-in will behave? Will it enabled because we have Optional connected exp. enabled? Secondly, what is the reason behind this change? Why MS has taken individual control setting away and mixed it with so many optional connected exp. where we do not have an option to choose which optional connected exp. we want to enable/disable. Its like all or nothing.  Read More

​

Can someone please explain how Copilot option present in Microsoft 365 mobile app relates to Copilot for M365? We have currently disabled the web content plugin in Copilot settings and also disabled copilot for Bing, Edge and Windows via MS provided PS script but still Copilot option is available in the M365 mobile app. When i did some tests, I can copy paste the content from other Intune managed apps e.g. from Outlook to this Copilot prompt in M365 app (which is also Intune managed) and the other way around also. Ideally this copy paste content should be possible because both the apps (M365 app and Outlook app) are organization managed but if we look at Copilot there, then its not the Copilot for M365 isn’t it? It shows the icon of Commercial Data Protection in chat interface and also it does not search the data from organization resources. So can we somehow disable this Copilot option in M365 app or block copy paste data from other Intune managed apps? Any ideas or views on this?

​Can someone please explain how Copilot option present in Microsoft 365 mobile app relates to Copilot for M365? We have currently disabled the web content plugin in Copilot settings and also disabled copilot for Bing, Edge and Windows via MS provided PS script but still Copilot option is available in the M365 mobile app. When i did some tests, I can copy paste the content from other Intune managed apps e.g. from Outlook to this Copilot prompt in M365 app (which is also Intune managed) and the other way around also. Ideally this copy paste content should be possible because both the apps (M365 app and Outlook app) are organization managed but if we look at Copilot there, then its not the Copilot for M365 isn’t it? It shows the icon of Commercial Data Protection in chat interface and also it does not search the data from organization resources. So can we somehow disable this Copilot option in M365 app or block copy paste data from other Intune managed apps? Any ideas or views on this?   Read More

​

You’re invited to Microsoft’s Chicago Office or Virtually

Join us in person or virtually with experts from Microsoft and Accenture for an immersive and interactive session to show how Copilot for Microsoft 365 will empower an entirely new way of working. Discover how this cutting-edge AI technology is bringing the power of next-generation AI to work and transforming the way how your organization does business.

Hear from industry experts including Dr. Tej Shah, Managing Director at Accenture, and many other healthcare technology thought leaders as they share best practices and innovation case studies they are seeing across the globe

Attendance in person is limited to 25 people only. Reserve your seat today and enjoy complimentary lunch and exclusive swag!

Sessions include:

Executive Opening

The Future of Healthcare

Introducing Copilot for M365

Copilot Overview

Voice of our customers

Empowering HLS Business Leaders with Copilot for M365
October 3rd  | 9:30 AM – 2:00 PM CST
Microsoft Chicago Office
200 East Randolph Drive, Suite 200, Chicago, IL 60601

View map >

REGISTER TODAY!

Schedule

9:30 am – 10:00 am 
Registration, Check-in, and Continental Breakfast

10:00 am – 10:15 am
Executive Keynote Introduction by Jesse Washington

10:15 am – 11:00 am
The Future of Healthcare & Q&A by Dr. Tej Shah 

11:00 am – 11:30 pm
Introducing Copilot for Microsoft 365 

11:30 pm – 12:00 pm
Lunch & Networking

12:00 pm – 12:30 pm
Copilot for M365 Overview – Why Copilot

12:30 pm – 1:00 pm
See Copilot for Microsoft 365 in Action with HLS-Specific Use Cases

1:00 pm – 1:30 pm
Voice of the customer – Panel Discussion

1:30 pm – 1:45 pm
Closing & Thank You

​Microsoft Tech Community – Latest Blogs –Read More 

Hello All ,

I have an pdf in my local machine, Normally I am able to digital sign that pdf using Adobe Acrobat reader as shown in below picture

When I upload the same pdf to Sharepoint and edit that pdf in sharepoint ad add some text on it like shown in in below image, and download the pdf to local machine and then the digital sign is not working

Digital signature is not being added after adding text into pdf using sharepoint

Here is some more info on error that i got from adobe

​Hello All , I have an pdf in my local machine, Normally I am able to digital sign that pdf using Adobe Acrobat reader as shown in below picture When I upload the same pdf to Sharepoint and edit that pdf in sharepoint ad add some text on it like shown in in below image, and download the pdf to local machine and then the digital sign is not working  Digital signature is not being added after adding text into pdf using sharepointHere is some more info on error that i got from adobe      Read More

​

Hello,

i’ve currently got 2 lists : 

list 1 is a catalog of toolslist 2 is a the tracking of orders from the catalog

my aim is to declare that there has been an order in the the catalog (list 1) by putting a “Y” in a column and then running a macro that will add the new lines into the list 2 without deleting the old ones and the sorting by “internal ref”

both lists are in the same work book just different pages 

My main question is how can i update list 2 with out deleting the lines currently present, nor creating duplicates ?

i was thinking about going ahead this way :

1 – fetch last line of list 2

2 – copy/paste or advanced filter to fetch all the orders

3 – sort by internal ref

but that doesn’t solve the duplicate error … maybe it could be done with an “if”  or ticking “unique records only” in the advanced filter?

if this option was to complicated i was thinking of a “place order” form that would update list 1 and then add the affected lines to list 2 … the form would need to be able to place multiple orders at once

list 1 looks like this :

Tool nametool versionInternal refTool priceOdered by XOrdered by YZTool 1ATool 1_ind A99  Tool 1BTool 1_ind B56 YTool 1CTool 1_ind C7Y Tool 2ATool 2_ind A456YYtool 3Atool 3_ind A456YYTool 4ATool 4_ind A46Y                         

List 2 looks like (once filtered by internal ref):

Internal refTool nametool versionClientinternal priceinternal order dateinternal delivery datecommentsclient ship dateTool 1_ind BTool 1BY     Tool 1_ind CTool 1CX     Tool 2_ind ATool 2AX     Tool 2_ind ATool 2AY     tool 3_ind Atool 3AX     tool 3_ind Atool 3AY     Tool 4_ind ATool 4AX                                         

​Hello, i’ve currently got 2 lists : list 1 is a catalog of toolslist 2 is a the tracking of orders from the catalogmy aim is to declare that there has been an order in the the catalog (list 1) by putting a “Y” in a column and then running a macro that will add the new lines into the list 2 without deleting the old ones and the sorting by “internal ref” both lists are in the same work book just different pages  My main question is how can i update list 2 with out deleting the lines currently present, nor creating duplicates ? i was thinking about going ahead this way :1 – fetch last line of list 22 – copy/paste or advanced filter to fetch all the orders3 – sort by internal refbut that doesn’t solve the duplicate error … maybe it could be done with an “if”  or ticking “unique records only” in the advanced filter? if this option was to complicated i was thinking of a “place order” form that would update list 1 and then add the affected lines to list 2 … the form would need to be able to place multiple orders at once  list 1 looks like this :Tool nametool versionInternal refTool priceOdered by XOrdered by YZTool 1ATool 1_ind A99  Tool 1BTool 1_ind B56 YTool 1CTool 1_ind C7Y Tool 2ATool 2_ind A456YYtool 3Atool 3_ind A456YYTool 4ATool 4_ind A46Y                           List 2 looks like (once filtered by internal ref):Internal refTool nametool versionClientinternal priceinternal order dateinternal delivery datecommentsclient ship dateTool 1_ind BTool 1BY     Tool 1_ind CTool 1CX     Tool 2_ind ATool 2AX     Tool 2_ind ATool 2AY     tool 3_ind Atool 3AX     tool 3_ind Atool 3AY     Tool 4_ind ATool 4AX                                             Read More

​

Hi everyone,

Recently, during the development process with the HoloLens 2, I encountered an issue where the device failed to boot properly. I attempted to restart the device several times, but the problem persisted.

While charging, One light fading in and out as mentioning in(https://learn.microsoft.com/en-us/hololens/hololens2-setup#lights-that-indicate-the-battery-level), followed by the startup sound playing repeatedly, and the device not functioning normally.

According to the documents, light to indicate problem, I judge the device battery might be very low, but after trying to plug in, and to charge the device, it seems not working.

Is there anything else I could try to get it working again?
Thank you kindly in advance for any suggestions.

​Hi everyone,Recently, during the development process with the HoloLens 2, I encountered an issue where the device failed to boot properly. I attempted to restart the device several times, but the problem persisted.While charging, One light fading in and out as mentioning in(https://learn.microsoft.com/en-us/hololens/hololens2-setup#lights-that-indicate-the-battery-level), followed by the startup sound playing repeatedly, and the device not functioning normally.According to the documents, light to indicate problem, I judge the device battery might be very low, but after trying to plug in, and to charge the device, it seems not working.Is there anything else I could try to get it working again?Thank you kindly in advance for any suggestions.  Read More

​

Entra ID federation with Google Workspace

Google Workspace federation allows you to manage user identities in your Entra ID tenants while authenticating these users through Google. This can be beneficial if your company wants to use a single source of identities across different cloud platforms.

This article covers the scenario where your domain is already added and verified in Entra ID.

Requirements

To use Google Workspace federation, you need to ensure that your federated users are created in the Entra ID directory. This can be done through various methods such as auto-provisioning or using the Graph API.

Keep in mind, that the out-of-the box federation for Google only works for gmail.com personal accounts. In order to federate with work accounts managed in Google Workspace, you have to configure SAML IDP federation. 

Configuring SAML Federation on Google Workspace side

To configure SAML federation in Google Workspace, follow these steps: 

1. Create a Web Application in Google Admin Panel:

Navigate to https://admin.google.com/
Go to Apps -> Web and mobile apps
Click Add app -> Search for apps
Search for “Microsoft Office 365” and install it.

2. Download Metadata:

After installing the app, go to the app details and download the metadata.
Save the IdP metadata file (GoogleIDPMetadata.xml) as it will be used to set up Microsoft Entra ID later.

3. Enable Auto-Provisioning:

Enable auto-provisioning inside the “Microsoft Office 365” app.

4. Configure Service Provider Details:

On the Service Provider details page:

Select the option Signed response.
Verify that the Name ID format is set to PERSISTENT.
Under SAML attribute mapping, select Basic Information and map Primary email to IDPEmail.

5. Enable the App for Users in Google Workspace:

Go to Apps -> Web and mobile apps -> Microsoft Office 365 -> User access.
Select ON for everyone and save the changes.

Adding Federation for SAML Provider in Entra ID

Using the IdP metadata XML file downloaded from Google Workspace, modify the $DomainName variable in the following script to match your environment, and then run it in a PowerShell session:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser -Force
Install-Module Microsoft.Graph -Scope CurrentUser
Import-Module Microsoft.Graph

$domainId = “<your domain name>”

$xml = [Xml](Get-Content GoogleIDPMetadata.xml)

$cert = -join $xml.EntityDescriptor.IDPSSODescriptor.KeyDescriptor.KeyInfo.X509Data.X509Certificate.Split()
$issuerUri = $xml.EntityDescriptor.entityID
$signinUri = $xml.EntityDescriptor.IDPSSODescriptor.SingleSignOnService | ? { $_.Binding.Contains(‘Redirect’) } | % { $_.Location }
$signoutUri = “https://accounts.google.com/logout”
$displayName = “Google Workspace Identity”
Connect-MGGraph -Scopes “Domain.ReadWrite.All”, “Directory.AccessAsUser.All”

$domainAuthParams = @{
DomainId = $domainId
IssuerUri = $issuerUri
DisplayName = $displayName
ActiveSignInUri = $signinUri
PassiveSignInUri = $signinUri
SignOutUri = $signoutUri
SigningCertificate = $cert
PreferredAuthenticationProtocol = “saml”
federatedIdpMfaBehavior = “acceptIfMfaDoneByFederatedIdp”
}

New-MgDomainFederationConfiguration @domainAuthParams

To verify that the configuration is correct, you can use the following PowerShell command:

Get-MgDomainFederationConfiguration -DomainId $domainId |fl

Test the federation

To test the federation, navigate to https://portal.azure.com and sign in with a Google Workspace account:

As username, use the email as defined in Google Workspace. The user is redirected to Google Workspace to sign in. 
After Google Workspace authentication, the user is redirected back to Microsoft Entra ID and signed in.

Troubleshooting

If you configured federation after users were created in Entra ID, it is possible that users will get an error AADSTS51004

AADSTS51004: The user account XXX does not exist in the YYY directory. To sign into this application, the account must be added to the directory.

This error is most likely caused by property ImmutableId being incorrect. 

For Google Workspace federation ImmutableId has to be set as a primary email adress of the user. 

Follow these steps to update the ImmutableID:

Convert the federated user to a cloud-only user (update the UPN to a non-federated domain)
Update the ImmutableId
Convert the user back to a federated user

Here’s a PowerShell example to update the ImmutableId for a federated user:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser -Force
Install-Module Microsoft.Graph -Scope CurrentUser
Import-Module Microsoft.Graph
Connect-MgGraph -Scopes ‘User.Read.All’, ‘User.ReadWrite.All’

#1. Convert the user from federated to cloud-only
Update-MgUser -UserId test@example.com -UserPrincipalName test@example.onmicrosoft.com

#2. Convert the user back to federated, while setting the immutableId
Update-MgUser -UserId test@example.onmicrosoft.com -UserPrincipalName test@example.com -OnPremisesImmutableId ‘test@example.com’

Conclusion

In summary, Entra ID federation with Google Workspace allows seamless user identity management and authentication across different cloud platforms.

Hit me up in comments if this worked for you!

​Microsoft Tech Community – Latest Blogs –Read More 

​  Read More

​