Office 365 - Not a good start

[Michael]

Hello all,

 

I've signed up a school to Office 365, registered and confirmed the domain ownership, created users via a CSV and now under licenses, all I can select are between two A3 plans. We'd like to use the A2 plan.

 

I tried the online chat facility/support from Microsoft and they themselves were unclear why A2 does not appear under licenses. Can anyone explain is this normal and how do I get A2 as an option to choose from? Many thanks!

[mwnci]

You need to 'Purchase' A2 licenses. Go to purchase on the left in the management portal. Add A2 Faculty and Pupil licenses to you cart, and place an order. As an educational establishment, they are priced at £0.00

[Michael]

I don't see purchases either. I visited here: https://login.microsoftonline.com signed in as admin.

[Michael]

This is all I see:

 

[mwnci]

Is your admin account a global administrator?

[Michael]

No idea - but when I re-logged in as the default administrator (before registering the real school domain), it gives me the options I'm looking for.

 

I have to say, this really is a design problem. The back end on Live@Edu was much more straight forward. I now have the task of allocating licenses. Why couldn't this have been done from the start with a CSV?

[Michael]

You were right about the Global Administrator setting Thanks!

[Michael]

Next question, how can I easily allocate licenses to a group of users?

[jamesbmarshall]

Sorry to hear you hit a few bumps along the way to deploying - but glad to see that you've finally been able to purchase the licenses you require. The reason they're not there be default is because we need to go through a process of verifying that you're eligible for the free service (by adding a education domain). Once you've verified a domain, and are logged in using an appropriate account you'll have access to purchase all the free and paid-for SKUs.

 

Licensing is handled on a per-user basis. It is possible to select multiple users from the GUI, or you could use Windows PowerShell to assign licences. As an example:

 

 

• Synchronise your tenant with your local AD using DirSync.
  
• Populate an attribute, say customattribute1, with some information (i.e. 1 = students, 2 = staff, etc.).
  
• Decide that students will get the Exchange Online component of Plan A2, staff will get Exchange Online, and Lync Online, etc.
  
• Write a PowerShell script that looks for newly provisioned users, reads the customattribute1 attribute, and then assigns corresponding licence SKUs depending on the value of the attribute.
  

 

Scripting licence assignment is fairly straightforward, and I've written a blog post that should help you get started.

[Michael]

Thanks James. What I'll do (when I've finished working my way around), is write a few mini guides, as I think Office 365 could do with tweaking slightly so other admins avoid the same traps I have

[jamesbmarshall]

Thanks James. What I'll do (when I've finished working my way around), is write a few mini guides

 

I'd love to see them if you do.

[Michael]

Here are my thoughts this afternoon

 

Signing up to Office365

 

When you first sign up to Office365, it prompts you to create a temporary domain. When you sign up to Live@Edu, you can use your existing domain from the beginning. I think it was better this way, as you just need to update your MX records when you're ready to move.

 

Adding Domains + First User

 

Once you're signed in as the administrator (using the temporary domain), you can add your real domain. Just like Live@Edu, you're then required to prove ownership (this is fine).

 

You then typically (as I did) wish to create an administrator account for my real domain. I did this, however there are a list of administrator roles to choose from. As a suggestion, the first account created should be a Global Administrator by default. Otherwise (like I did), if you choose any other administrator role, the 'Purchasing' of licenses is not possible. This even confused Microsoft Support when I asked the question and it could easily be avoided.

 

Users and Licenses

 

Creating a CSV file is straight forward and importing users is straight forward too. No where does it suggest however to setup licensing (as a recommendation) before importing users. If you do this the other way around, you'll need to set licensing manually per user. As a result, I was forced to delete my newly imported users and start again.

 

Setting up licensing first allows the Office365 import process to also add users into the correct licensing package you have purchased automatically.

 

When you've imported your users, there's a small 'log' link. You can open/print this for a list of usernames/passwords. This is useful, but I only clicked on it by chance.

 

Improvements to be Made

 

When adding your real domain, you should be prompted to create a Global Administrator by default - this is the case with the temporary domain anyway!

 

Before adding users (in bulk), the admin should be recommended to evaluate licensing packages first.

 

Setting up Security Groups is simple enough, but adding users into groups is a nightmare. You have one huge list. When importing via CSV, you could include an additional 'Group' column. If the group doesn't exist (when imported), then it gets created. What's the solution for this as it stands?

 

It still isn't possible to include aliases in the CSV.

 

Users are still prompted to confirm their Time Zone at logon. I am aware there's a PowerShell script to get around this, but again, this could be included within a CSV optionally.

 

There still isn't a way to automatically allocate Calendars to users. Users still have to accept the calendar.

 

I think (just like Active Directory), admins should be able to specify the password policy for Office365, rather than be forced. The requirements are too high in my opinion. It would be useful to have the option to blacklist commonly used passwords for example too.

 

Thanks for reading!

[jamesbmarshall]

 

Signing up to Office365

 

When you first sign up to Office365, it prompts you to create a temporary domain. When you sign up to Live@Edu, you can use your existing domain from the beginning. I think it was better this way, as you just need to update your MX records when you're ready to move.

The process for signing up for Live@edu meant that unless you had a domain spare you couldn't really get access to the service, even if you just wanted to evaluate. By doing it this way round with Office 365 it allows customers to evaluate the service for 30 days without needing their own domain name, as well as being able to just get started from day one. The .onmicrosoft.com domain that you get as part of signing up is a requirement, and has no impact on your ability to use any other domain names (in fact, it's very useful when it comes to federating).

 

 

Adding Domains + First User

 

Once you're signed in as the administrator (using the temporary domain), you can add your real domain. Just like Live@Edu, you're then required to prove ownership (this is fine).

 

You then typically (as I did) wish to create an administrator account for my real domain. I did this, however there are a list of administrator roles to choose from. As a suggestion, the first account created should be a Global Administrator by default. Otherwise (like I did), if you choose any other administrator role, the 'Purchasing' of licenses is not possible. This even confused Microsoft Support when I asked the question and it could easily be avoided.

 

You should keep your "super admin" in your .onmicrosoft.com domain as you will always be able to access this even if you chose to federate any other domains that subsequently suffer an outage (i.e. because your local federation server goes down). The administrator roles are there to allow you to devolve power to others, but purchasing licences carries a potential cost which is why it is restricted. Generally speaking, you don't need to adjust your licence count on a daily, or even monthly, basis.

 

Users and Licenses

 

Creating a CSV file is straight forward and importing users is straight forward too. No where does it suggest however to setup licensing (as a recommendation) before importing users. If you do this the other way around, you'll need to set licensing manually per user. As a result, I was forced to delete my newly imported users and start again.

 

Setting up licensing first allows the Office365 import process to also add users into the correct licensing package you have purchased automatically.

 

When you've imported your users, there's a small 'log' link. You can open/print this for a list of usernames/passwords. This is useful, but I only clicked on it by chance.

 

You can bulk assign licences after you create your users as well - just select multiple users in the portal and you can edit them together. The GUI is just one way to do this - if you're looking for something more easily automated look at DirSync to handle user provisioning, and Windows PowerShell to manage passwords and licences.

 

 

Improvements to be Made

 

When adding your real domain, you should be prompted to create a Global Administrator by default - this is the case with the temporary domain anyway!

 

You don't need an administrator account for every domain. Your .onmicrosoft.com administrator account will be able to administer users in other namespaces, and as previously mentioned, it's advisable to keep your admin in that namespace.

 

Before adding users (in bulk), the admin should be recommended to evaluate licensing packages first.

 

Setting up Security Groups is simple enough, but adding users into groups is a nightmare. You have one huge list. When importing via CSV, you could include an additional 'Group' column. If the group doesn't exist (when imported), then it gets created. What's the solution for this as it stands?

 

The solution is DirSync. Managing your tenant exclusively using CSV imports is possible, but I strongly recommend DirSync to sync your local AD with Office 365 - this will handle that sort of thing automatically; it also means you have one single place to manage your users: your local AD.

 

It still isn't possible to include aliases in the CSV.

 

Users are still prompted to confirm their Time Zone at logon. I am aware there's a PowerShell script to get around this, but again, this could be included within a CSV optionally.

 

It's possible to write yourself a little PowerShell script to import users, set their password, dictionary language and regional settings, and any other details. The logic being:

 

 

• Import users from CSV
  
• For each user imported run a bunch of configuration settings
  

 

There still isn't a way to automatically allocate Calendars to users. Users still have to accept the calendar.

 

I think (just like Active Directory), admins should be able to specify the password policy for Office365, rather than be forced. The requirements are too high in my opinion. It would be useful to have the option to blacklist commonly used passwords for example too.

 

If you want to dictate your own password strength policies you can deploy AD FS 2.0 or Shibboleth; this moves the authentication to your local AD and users will be required to adhere to whatever local password policy you have in place. Obviously, we strongly recommend that you adopt a strong password policy.

 

Thanks for all your points Michael; you've certainly given some great feedback. Hopefully my comments are useful - I accept that there are differences between Live@edu and Office 365 that take some getting used to.

 

If you're already on Live@edu have you given any thought to upgrading?

[Michael]

Thanks for the feedback James. At the current time I have no plans to move existing schools from Live@Edu to Office365. Live@Edu has been in place for literally months and plus there are some differences with Office365 I'm still learning (you can probably tell).

 

I've decided importing/creating users via the CSV method is better. Many Primary schools I work at would typically have one Domain Controller and do not have the available funds to invest in another server. As you pointed out, if that single Domain Controller goes down then it would create a whole range of problems. For example, if that Domain Controller went down over the weekend, it would also mean users couldn't log into their e-mail from locations outside of school.

 

Also, many Local Authorities they have a tendency to do maintenance work during the weekends or school holidays. If internet connectivity to that Domain Controller is lost, again it would stop users accessing e-mail out of hours. This is something I have no control over.

 

To be honest, I think the SSO solutions are better suited to larger educational establishments or businesses, rather than Primary schools. It just isn't realistic. I think the majority of schools I've ever been to have relaxed the 2003/2008 Server password requirements. Why you may ask? For the simple fact it's too difficult for young children and I've mentioned this on numerous occasions in the past. This is one reason why I won't move schools from Live@Edu to Office365. The password requirements need to be relaxed.

 

The irony here is that with an SSO solution in place, users could have their Office365 password as 'password' if they so wished. By all means, like 2003/2008 Server, let the password requirements be high by default, but still allow schools to reduce the requirements.

[Michael]

Here are some commands that will help Office365 admins:

 

Import Office365 cmdlets (both files) here

 

Sign in to PowerShell:

 

import-module MSOnline

 

Then enter:

 

connect-MsolService

 

Set passwords for users (bulk):

 

Get-MSOLUser | Select UserPrincipalName|Export-Csv C:\temp\office365.csv

 

Once you've created the office365.csv file, open it and filter out staff e-mail addresses and the admin account. Save the file. Cut and paste staff e-mail addresses into a new file office365staff.csv.

 

Command to run for pupils:

 

Import-Csv c:\temp\office365.csv |%{Set-MsolUserPassword -userPrincipalName $_.UserPrincipalName -NewPassword School123 -ForceChangePassword $false}

 

Command to run for staff:

 

Import-Csv c:\temp\office365staff.csv |%{Set-MsolUserPassword -userPrincipalName $_.UserPrincipalName -NewPassword Teacher123 -ForceChangePassword $true}

 

Set passwords to never expire:

 

Get-MsolUser | Set-MsolUser –PasswordNeverExpires $True

 

View password policy for domain:

 

Get-MsolPasswordPolicy –DomainName domain.sch.uk

 

Any ideas how disable Messenger in Office 365? The command for this in Live@Edu was (see below). I found this, but can't get it to work. Any ideas?

 

Set-OwaMailboxPolicy OwaMailboxPolicy-DefaultMailboxPlan -InstantMessagingEnabled $false

[Michael]

Does anyone know the command to remove Messenger in Office365 (so it doesn't appear on the left hand side)?

 

Also, is there anyway users can be directed straight to their e-mail rather than the home page by default? Many thanks!

[jamesbmarshall]

If you don't want users to have IM, don't assign them a Lync licence.

 

As for OWA, go to http://outlook.com/yourdomain.com.

[Michael]

Thanks, your OWA solution works.

 

Unfortunately I've tried disabling Lync, waiting 15 mins and it's still there after I've logged out then back in.

[Michael]

I have to say, the GUI admin console on Office 365 is buggy as hell. For example try this -

 

Management > Users, set the amount of users to 250 per page. Click the arrow pointing right to see the next 250, then click the Username field. It changes the whole user list and not the 250 users I'm looking at.

 

Again, select Management > Users, set the amount of users to 250 per page. Click the arrow pointing right to see the next 250. Select all users, then click Edit. It ignores the request and returns to the first 250 users.

 

I can re-create this problem in IE9 and FireFox 15. Bearing in mind how long Office 365 has been out, I am surprised to find silly bugs like this.

[british_government]

Im not sure I saw this answer for the purchasing extra subscriptions, the A2 plans are only available to add 2 weeks after the first 365 signup/transfer.

 

Also as we are asking questions, has anybody got user pictures working with directory sync? They are showing in lync but not owa, and meet the 96x96px rule and are only 2kb

[jamesbmarshall]

Unfortunately I've tried disabling Lync, waiting 15 mins and it's still there after I've logged out then back in.

 

15 mins is not necessarily long enough for the licence changes to fully take effect. If the user has no Lync licence the IM block will not work.

[jamesbmarshall]

Im not sure I saw this answer for the purchasing extra subscriptions, the A2 plans are only available to add 2 weeks after the first 365 signup/transfer.

 

It shouldn't take two weeks to verify your eligibility for Office 365 for education; you can add in a domain during sign up and should be able to start purchasing academic SKUs within a couple of days (probably hours, maybe quicker) but not weeks. If you are having difficulties log a support request.

[Michael]

15 mins is not necessarily long enough for the licence changes to fully take effect. If the user has no Lync licence the IM block will not work.

 

Thanks James, I will certainly bear this in mind. Will you please investigate the bugs I've reported? To edit user licenses in bulk, I've had to delete them and re-create them.

[british_government]

It shouldn't take two weeks to verify your eligibility for Office 365 for education; you can add in a domain during sign up and should be able to start purchasing academic SKUs within a couple of days (probably hours, maybe quicker) but not weeks. If you are having difficulties log a support request.

 

This is the official Microsoft line, when your account is upgraded only the "Exchange Online (Plan 1) for Students" is available, I contact Microsoft directly about this and it does take exactly 14 days before you can purchase other plans (even the free ones) which is an intentional design of their system. This is the exact setup I experienced was exactly 14 days after upgrade that we could add these plans, if you are telling me this is wrong you will need to contact 365 support and let them know it isn't intentional and is an issue.

Edited October 25, 2012 by british_government

[jamesbmarshall]

This is the official Microsoft line, when your account is upgraded only the "Exchange Online (Plan 1) for Students" is available, I contact Microsoft directly about this and it does take exactly 14 days before you can purchase other plans (even the free ones) which is an intentional design of their system. This is the exact setup I experienced was exactly 14 days after upgrade that we could add these plans, if you are telling me this is wrong you will need to contact 365 support and let them know it isn't intentional and is an issue.

 

Can you send me a PM with your support reference number and some details please? I am 99% certain this is incorrect information.