Office365 user permissions/configuration.

[Garacesh]

I'm sure I'll have more questions as I progress through setting up Office365 for our school, but for now there are two main 'biggies' I'm struggling with and no matter what I've tried I can't seem to find a solution to them.

 

1) From where does Office365 pull down peoples' names? Given that it synchronises with Active Directory I would have expected it would just take whatever name AD had for the users.. Apparently this isn't the case. We have several members of staff that have married and changed their names since joining. Their AD accounts have been modified to reflect this, but somehow Office365 is finding their old name. Consider Jane Bloggs becoming Jane Johnson. I have checked every single possible attribute of the user (as supplied by TechNet).. The only things that bear any resemblance to her name are DistinguishedName, Name, SamAccountName, Surname and UserPrincipalName.. All of which are referencing the new name.. Yet the Office365 email address has generated as BloggsJ@ instead of JohnsonJ@..

 

2) Stopping students creating groups. I have created a new Role Assignment Policy as per this KB article. The only roles I have assigned to this new policy are MyBaseOptions and MyMailSubscriptions. The roles that supposedly let you create and manage groups, MyDistributionGroups and MyDistributionGroupMembership, are both definitely unticked. However when my test user, who has been assigned the policy in place of the Default Role Assignment Policy, is still able to create groups.

[tekins]

Sorry if this isn't what you are after, but for us, it's the display name from AD that shows in 365, some staff like Mr Bloggs, some prefer Joe Bloggs.

The email addresses are set in the proxy addresses part of the Attribute Editor, in the format SMTP:[email protected] - capital SMTP for primary address, if we have a name change, we just add the new address as primary, leaving the old one as it was, that was emails can be sent to both.

 

We have prevented everyone from creating groups, can't remember how though, i think it was using powershell!

[Garacesh]

Can the user login with the new address though? If Mrs. Smith has both "Jane Smith" and "Jane Doubtfire" addresses, which would she login as? Or do both addresses appear in the user settings and I can choose whichever, similar to how I changed all the users from @onmicrosoft addresses?

[tekins]

To log in with the new name, you need to run a remote PS cmdlet to set the UPN.

 

Example: Set-MsolUserPrincipalName -UserPrincipalName [email protected] -NewUserPrincipalName [email protected]

 

For some reason this can't be done using dirsync

[Garacesh]

Fantastic! That's worked and now the married members of staff can login with their proper names. Swish.

 

Any luck with that powershell script? It seems taking the kids off the 'Premium Client' (Outlook web app policies) removes the option to create new rules, but I'm not sure if that disallows them or just hides it.

[tekins]

Found this in a file called "No group creation" on the dirsync server, may well be what we ran.

 

set-OwaMailboxPolicy -GroupCreationEnabled $false -Identity OwaMailboxPolicy-Default

 

Maybe worth a google to see if that is what you need.

[Garacesh]

Set-OwaMailboxPolicy is not recognized as the name of a cmdlet.

 

By the looks of it, though, that would just make the default policy not enable group creation.. My test account is using a different policy, not the default one, and this new policy doesn't have it enabled in the first place. The only permissions the policy assigned to my test account has are MyBaseOptions and MyMailSubscriptions.