HPlum78

So when I say points of pence its 0.022p per 10000 operations (basic) or 0.112p per 10000 operations (advance). So even if you are talking 10000 accounts and it's classed as advanced operations and the script is making multiple calls to the key vaults it's still pennies.

So I would do something with Flow (or whatever we are calling it this week...) and a SharePoint list that holds the response.

Keyvault price is based on reads/ writes and it's points of pence per operation, I guess you are looking at this process: https://docs.microsoft.com/en-us/microsoft-365/enterprise/cross-tenant-mailbox-migration?view=o365-worldwide

Go with a resolvable address, using a .local address with split brain DNS just adds an administrative overhead and is largely discouraged now.

Ah I see yeah that what I have said ain't any use then... Good luck.

No need for admin rights as @Steve21 has said (that way madness lies) I have talked about this a few times and there are a ton of ways to skin this cat, we use our helpdesk system. The users puts in a request and we use Flow and other tools like PS to check the request and setup the team (this includes checking that certain words are not in the name and the team has two owners, checks for duplicate teams and such likes). You could use a sharepoint list with a form and get flow to create the teams based on that list (is another way). I could go on.... Happy to talk to anyone directly about how to get a service wrapper set up for Teams creation even offer some insights in the Flow/ code to achieve this if that would help PM me.

When an email is sent to an aliases is it not resolved to the actual email address before being delivered, I thought it was, not in front of a computer but if you do a message trace on a mail that you send in to an aliases you can see the steps that are taken. Not absolutely sure, but it may mean that you don't need to consider reporting on mail in to aliases, if you see what I mean.

Had to go to an appointment but it looks like the collective have hooked you up :-)

https://www.microsoft.com/en-gb/download/details.aspx?id=30005 Download the above and run it in the first instance. It will give you a run down in a more (better) format and list out the priorities in order. I cannot see how many DC's there are in your topology, where are the FSMO roles at the min? https://devblogs.microsoft.com/scripting/powertip-use-powershell-to-get-list-of-fsmo-role-holders/ That will get them out in a nice list. On my phone and scrolling through verbose errors is let's say sub optimal.

Yeah I have seen contractors on ~£1200 a day recently so if you have a skill in demand you can certainly make your money.

I would say it depends on what your offering is, if you can get into integration, service wrappers and blended learning solutions (steer away from hardware) there is a market place for sure. What was you thinking about?

The teams client caches the photos so if you want to speed teams up you could kill the cache. Get-ChildItem "C:\Users\*\AppData\Roaming\Microsoft\Teams\*" -directory | Where name -in ('application cache','blob storage','databases','GPUcache','IndexedDB','Local Storage','tmp') | ForEach{Remove-Item $_.FullName -Recurse -Force} That would kill the cache for all users that have logged on to a work station and used the teams Client. I would also (I know that the above don't follow this) but ditch the foreach and use users.foreach instead as the performance difference is massive... I have posted about this very thing hunt them out if your interested.

So we have @student.x.y.z and no suffix for staff

I have not used Azure Cloud Sync but from what I have just read its an entirely different solution to AAD Connect. You will still need to sync your local AD directories to your single cloud tenant. And as noted above you are going to need to do this via a single AADC server on one site or another (or as I say in Azure for what it's worth!). This will then let you assign the required office licences to your users (and give them One Drive). Azure Cloud Sync looks as if its adds a cloud tier of storage to your local file share solution (so departmental file share areas (D drive) for talking sake) and share them using the same/ already well understood technology along with leveraging ACL's that are under pinned by your local AD infrastructure. That's how I have read it in my real quick skim this morning (there could be more to it) So in summary AAD Connect is for syncing local AD objects to Azure (then this is synced to your M365 tenant and sharepoint, blah bla blah..) the other seems to be associated with syncing/ extending file shares on to cloud storage. I could have got the wrong end of the stick here tho...

@Norphy is not wrong its not a great place to find yourself in, and I should have been clear that I say sort out the SQL means you will be taking an outage on the SQL service but I thought that had been covered further up this thread. Either way I think you are rebuilding a DC and SQL server.

I would setup a new DC transfer all the FSMO roles and such likes (DNS (if not AD integrated) DHCP and those types of services) then dcpromo that server out and sort out the SQL stuff.... Thing is if you need support chances are you are going to get told to do that anyway.

Or stand the AAD Connect server up in Azure and connect it to each site.

So for what it's worth as I have only just seen this you could setup a group in AD called CompromisedAccounts (what ever you want) and then have a script that looks at that group continually for accounts that get dropped in it and then runs all the bits to disable the account, remove the tokens and reset the password and such likes in one go. All you are then doing is dropping in the accounts to a group. This is what we do and you can limit who is able to add accounts to the group and what accounts are allowed to be added and how many accounts are processed in one go and all that jazz...

First though is where are these clients hitting, WAP server or backend ADFS server? Could be going down the wrong path but it's late...

Is this your only DC? If not can you just rebuild it? I don't like this approach but VMs should be cattle not cats.

Yeah interesting DevOps as a role its really a methodology, I develop to this methodology myself but am not called a DevOps Engineer/ Manager! I am not sure that it is a defining name for being serverless either. I do say this about job titles, you can call me what you want as long as you pay me my money! Its too easy to get caught up in a title I bet that 99.9 % of this forum do not do the job that our titles describe. As I threw into the mix earlier I think as schools and trusts grow the hierarchy changes and more specific roles need to be defined and filled.

How many of you class your role as purely development? When trust gets to a certain size do you start thinking of having a role that is solely for development? I know that in a single/ small trust dev roles are essentially any spare time that the IT/network manager (or director of) has. That leads me on to the next question at what point do you guys find that the board level role is just that? So have to give up the technical aspects of IT and solely focus on the strategic stuff.

Yeah my mum is Irish and I seem to remember that she had a neighbour with the surname Foot2 :-p

@free780 I think that MS said that they where going to disable basic auth, now that clearly implicates those protocols that only support basic auth... But they had committed to overhauling those protocols from memory well the ones that people really care about (SMTP, IMAP I don't think that POP made the cut!) to support Oauth..... In fact this is the announcement that I remember: https://techcommunity.microsoft.com/t5/exchange-team-blog/announcing-oauth-2-0-support-for-imap-and-smtp-auth-protocols-in/ba-p/1330432

So sometimes when networks are setup they will exclude parts of the range for network hardware and such likes or / down the allocation. Give us an idea of the range? Also I would suggest root causing the issue with DHCP rather than moving to a static allocation (that way madness lies!) happy to help where I can.