Office 365 - Groups & Global address list

[Wubbalubbadub]

Happy Monday all,

 

Just wondering if anyone has this problem.

 

We are using Office 365 for staff and students. I am having trouble with the global address book.

 

Students were making there own groups in Office 365. Some of the groups (As students do) were inappropriate. I have since deleted the groups and stopped students making groups by disabling groups using a powershell command I found for office 365.

 

So far... Super (Exactly what i want)

 

However a teacher has now come in saying that students need to make groups in email as part of a syllabus. So my question to you all. Can I enable groups but stop them from going into the global address book?

 

Matthew

[themightymrp]

Not entirely sure why they are ending up in the global address list anyway but, when I make groups (for myself) I do this:

 

In Outlook Web App, click on People at the top right. Click New - choose to Create Contact List.

 

This creates a distribution group but only for me. It doesn't appear in the GAL...?

[Wubbalubbadub]

Maybe i'm getting confused and that is what the students are doing. Is there any way to stop students from being able to add anything to the global address book?

[themightymrp]

Not sure where you would block this specifically, but looking into it:

 

From your Inbox, click the cog at the top right and go to options.

Quite a way down the left hand side is an option called Distribution Groups

If you create one here it will add it to the GAL - this is different to doing from with the 'People' tab

 

You should be able to find a way to block off this portion of Options I would imagine?

[themightymrp]

OK, 'may' have the answer.

 

Go to your Exchange Admin Center. Then go to Permissions down the left side.

 

Go to the 'user roles' tab. If, like me, you haven't changed this then you will have the Default Role Assignment Policy. This will be applying to your students. In the settings for this is the ability to create and modify distribution groups.

 

I haven't tried it but removing this ability may be what you want. It depends if you want staff to be able to do it too? If you do then you may need to create some custom role assignments and apply them to staff/students accordingly. I would assume the without this permission they will still be able to create contact lists within their own personal contacts

[Wubbalubbadub]

OK, 'may' have the answer.

 

Go to your Exchange Admin Center. Then go to Permissions down the left side.

 

Go to the 'user roles' tab. If, like me, you haven't changed this then you will have the Default Role Assignment Policy. This will be applying to your students. In the settings for this is the ability to create and modify distribution groups.

 

I haven't tried it but removing this ability may be what you want. It depends if you want staff to be able to do it too? If you do then you may need to create some custom role assignments and apply them to staff/students accordingly. I would assume the without this permission they will still be able to create contact lists within their own personal contacts

 

You sir. I owe a pint!

[themightymrp]

I guess that was it then hah!

[Wubbalubbadub]

It was indeed.

 

However now I have a problem. The students can make groups now as I want... However the groups are being added to the global address list... Which I dont want. Can I allow students to make groups but not be added to the global address list?

[themightymrp]

Is that not the same problem you started with? I can't think why they would be adding to the GAL. Do you have a separate GAL for staff and students or is it all one big one?

 

I will look into this further....

[themightymrp]

Expanding on the Default Role Assignment settings, take a ganders at this page:

 

The EXPTA {blog}: How to Configure Granular Permissions to End Users for Distribution Group Management

 

You may be able to tweak the setting to add a tickbox which will allow you to remove the ability to create groups in the GAL. If it's not this then you may be best asking someone like @jamesbmarshall or @Edu-IT

[Wubbalubbadub]

Well you in advertinatly made it so we can stop users from accessing the global address list and making changes in there. But when they go to the left hand side to make groups they just populate the global address list instantly. So all the staff can see them.

 

WE just have one big list as we do want staff and students to be able to communicate together.

[JRowley]

You might be able to use a resource filter on your GAL to filter out groups, however this would prevent staff groups from being visible too, is that an issue?

 

How often do staff (or students for that matter) need to create groups?

[Wubbalubbadub]

You might be able to use a resource filter on your GAL to filter out groups, however this would prevent staff groups from being visible too, is that an issue?

 

How often do staff (or students for that matter) need to create groups?

 

Is there possibly a way to filter out all public groups? So any made from students don't show up but the ones I have do?

 

Well apparently it is part of the syllabus now so for a while I imagine.

[JRowley]

To be honest I haven't gone into that much detail myself, you might be able too do that check, but it's not something I have explored.

[JRowley]

Right just an update, you can use a RecipientFilter for the GAL and then check against the RecipientTypeDetails of the object, if the object equals GroupMailbox then it will be included in the address list, if not then it wont.

 

Here is a link for configuring a recipient filter - Filterable properties for the -RecipientFilter parameter: Exchange 2013 Help

And a link to general filtering with powershell/OPATH - Filters in recipient Shell commands: Exchange 2013 Help

 

My advice would be to create a new address list so you can play around with the recipient filter without breaking your GAL. Also as far as I can tell there is no way of determining with the Recipient Filter if a group is private or public.

[Edu-IT]

Expanding on the Default Role Assignment settings, take a ganders at this page:

 

The EXPTA {blog}: How to Configure Granular Permissions to End Users for Distribution Group Management

 

You may be able to tweak the setting to add a tickbox which will allow you to remove the ability to create groups in the GAL. If it's not this then you may be best asking someone like @jamesbmarshall or @Edu-IT

You mean @EduTech?

[themightymrp]

Sorry yes

[Wubbalubbadub]

Thanks to everyone. Really appreciate the input.

[sparkle263]

found this and it works:

Set-UnifiedGroup -Identity [email protected] -HiddenFromAddressListsEnabled $true