Custom Address Lists and Using AD Groups

[tubs]

Hi

 

 

 

Hi! I wonder if anyone can cast any insight to address book policies on office365.

 

So, I've originally set up Custom Address Book polices for schools on 0365. The way I did this was using Groups in on PremAD, then setting those groups as "filters for the GAL / Address List policies. Up until October, this was working as expected.

 

Around October, there were staring to be reports of people not appearing on the address lists, in Outlook or on o365 - it's eventually made it's way through to me after other have looked at it, and I've opened a call with MS, to put it bluntly have been uselss, even at turning up for arranged calls!

 

Basically, the address lists that is shown in 0365/Outlook people have "disappeared" - it's now at the point that there are only 1 or two people in those lists, and I've had to start reverting users back to "no address book policy".

 

1) The users are still in the AD group.

2) The users are still in the Azure synced AD group

3) The address lists are set to with a recipient filter of "Azure AD Group"

4) When I query the address lists with PowerShell, it seems that the user are "there".

5) But the 0365 and the Outlook Address lists done't show (all) of the users/groups/mailboxes as expected.

 

Annoyingly, I've extended out schema for usercreation/group creation, and although the attributes used are synced up to 0365, they can't be used as to filter users in address lists (all users have a custom attribute that give a school code, type of user, etc etc)

 

Looking further and further into it, there is an attribute that users have called Name AddressListMembership, and where people are being displayed in the ALs, they have expected, but it seems something might be overwriting that AddressListMembership attribute, with other item.

 

So for an example the two last working staff members i have

 

{\Default Global Address List, \GAL-SCHOOL, \AL-SCHOOL-All Staff, \All Users…}

 

Where as another user not being displayed has

 

{\Default Global Address List, \All Users, \Offline Global Address List, \All Recipients(VLV)…}

 

Example code I've used is below to create, I may just be unique with this set up, hopefully not :-)

 

SCHOOL

*** Create GAL ***

new-GlobalAddresslist -name "GAL-SCHOOL" -RecipientFilter "MemberOfGroup -eq 'CN=UG-SCHOOL-GAL-All Users and Groups,OU=0365.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=GBRP0000000,DC=PROD,DC=OUTLOOK,DC=COM'"

 

*** Create OLAB ***

New-OfflineAddressBook -name "OAB-SCHOOL" -AddressLists "GAL-SCHOOL"

 

*** Create room AL ***

new-addresslist -name "RMAL-SCHOOL-All Rooms" -DisplayName "SCHOOLNAME Rooms" -RecipientFilter "MemberOfGroup -eq 'CN=UG-SCHOOL-RMAL-All Rooms,OU=0365.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=GBRP0000000,DC=PROD,DC=OUTLOOK,DC=COM'"

 

new-addresslist -name "AL-SCHOOL-All Staff" -DisplayName "SCHOOLNAME All Staff" -RecipientFilter "MemberOfGroup -eq 'CN=UG-SCHOOL-AL-All Staff,OU=0365.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=GBRP0000000,DC=PROD,DC=OUTLOOK,DC=COM'"

 

new-addresslist -name "AL-SCHOOL-All Groups" -DisplayName "SCHOOLNAME All Groups" -RecipientFilter "MemberOfGroup -eq 'CN=UG-SCHOOL-AL-All Groups,OU=0365.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=GBRP0000000,DC=PROD,DC=OUTLOOK,DC=COM'"

 

new-addresslist -name "AL-SCHOOL-All Students" -DisplayName "SCHOOLNAME All Students" -RecipientFilter "MemberOfGroup -eq 'CN=UG-SCHOOL-AL-All Students,OU=0365.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=GBRP0000000,DC=PROD,DC=OUTLOOK,DC=COM'"

 

new-addresslist -name "AL-SCHOOL-All Governors" -DisplayName "SCHOOLNAME All Governors" -RecipientFilter "MemberOfGroup -eq 'CN=UG-SCHOOL-AL-All Governors,OU=0365.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=GBRP0000000,DC=PROD,DC=OUTLOOK,DC=COM'"

 

SCHOOLNAME Address Book Policy

 

New-AddressBookPolicy -Name "ABP-SCHOOL-Staff" -AddressLists "AL-SCHOOL-All Staff","AL-SCHOOL-All Students","AL-SCHOOL-All Governors","AL-SCHOOL-All Groups" -OfflineAddressBook "\OAB-SCHOOL" -GlobalAddressList "\GAL-SCHOOL" -RoomList "\RMAL-SCHOOL-All Rooms"

[Boredguy]

When I setup our Address Book Policies many moons ago, I used "Office" field in AD instead of assigning them to AD groups, as it was the recommended method to use (even the extentionAttribute ones could be used)

 

You might find that is a method method that the groups

[tubs]

It's possible that I'll have to look at doing it differently as the way I have it set up now is not working (possibly writing scripts that copies data into extensionAttribute1 etc). But it was working, now it isn't ...

 

I have found one document, https://microsoft.github.io/ComplianceCxE/resources/files/Building_Advanced_Queries.pdf, that has the following in "NOTE: As of now, MemberOfGroup and Members are not supported with Adaptive Policy Scopes"" but this is a document is about "AdaptiveScopes". The MS documentation for RecipientFilter still lists memberOfGroup as a valid query.

 

The problem I find with "automatic" groups like this, is that I always get asked to make exceptions - part of the reason for having a controlled groups rather than having a automatic filter. (Indeed I was asked to take one perosn off the a previous address "All staff addressbook" as they were suspended but still employed, but not off their department address books as they still needed to be availabel to the department ...)

[tubs]

I've eventually found the main issue, but there are two different issues - I went back through my notes and found the command I originally used, so they were similar to this :

 

new-addresslist -name "RMAL-SCHOOL-All Rooms" -DisplayName "SCHOOLNAME Rooms" -RecipientFilter "MemberOfGroup -eq 'CN=UG-SCHOOL-RMAL-All Rooms,OU=0365.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=GBRP0000000,DC=PROD,DC=OUTLOOK,DC =COM'"

 

Now the DC=GBRP000000 was working and as I set it, ..

 

At some point, all of the address lists in Office365 had this key changed - I assume we might have been moved from one backend to another, and Microsoft movement updated all the address lists to the new one, lets say DC=GBRP1111111, so when I listed an address lits it shows this new number, and when i looked at the groups, this was the correct number.

 

Because I had the old code still that I used, I could see that they were changed. I then ran a "set-addresslist" on an existing policy, using the new code even though the old code had the right GBRP code, retickled everyone and magically it started working. So whatever MS had done had broken those ALs.

 

MS support were shocking, the final response via a call, was that we had over 500 users in our tenancy and Address Lists don't support that, and he closed the call on me.

 

The second part I have not been able to "fix" yet, but I'm now guessing that Address Lists might have a maximum length of name, but I have further diagnosis to do with that.

 

So final result is that most of the Address Lists (eg the ones I set up for each site) that I created before, after "re-setting" and tickling the users/groups are working.

 

Some new address lists that should work, are not, but i think that is due to group/address lists name lengths and isn't related to the above issue ...