chaplic

Only way I can think is to completely separate the two directories with information barriers but that causes more problems that it solves You could have a power flow with a webhook into the security log that detects when someone is added to a group, looks at the person who added then, then removes as required. Which is fairly complex and might create more trouble than it's worth by notifications of being adding and removed. Perhaps a similar approach would be to get a report from the Azure AD log of who added who to a group and share with a teacher and let them tackle it retrospectively. You cannot configure out bad behaviour and surely there are some reasonable use cases.

Dont know the default settings off top of my head, but suggest the domain that 'works' probably is closer to it. I would also troubleshoot with AD Users and Computers rather than file and permissions, hopefully removing a layer of complexity. From a nonprivileged user you'd normally expect to be able to connect to any trusted domain and browse it. I'm guessing that the 'bad' domain cannot be browsed in the same was as you cannot browse it.

Does it route out via on-prem, assuming it's a cloud mailbox or vice-versa?

I recall a config called 'list object mode' that would achieve that (if that's what you wanted to achieve). In short, permissions. What do OU perms look like on 'bad' domain compared to 'good' domain Over-and-above that I wonder if all appropriate UPN suffixes are routed through the trust?

There are supported customisations you can do to ADFS and unsupported hacking of the various pages is easily doable if you feel so inclined. If you really wanted a bespoke website you'd either have to write your own SAML IDP implementation. But overall, you'd look much better by doing away with complexity and points-of-failure that are under your direct control. Use Password Hash Sync and do away with the need for load balancers, reverse proxy, ADFS servers, firewalls, multiple sites, SSL certificates, monitoring...

Any reason you're using the old school RPTs and not the shiny new compliance.microsoft.com ? I should also note that you may surprised how many people 'keep' email in the deleted items..

I would be very, very surprised to see an email from one user on a tenant straight to another going into spam. Are you sure some odd connector isnt sending it out of tenant and back in? Whats does message tracking say? is your SPF record current and including office?

Yep. The company I was testing this for already have such an arrangement in production, with about 300 people -> sub1.company.com ->Tenant A 2000 people -> company.com-> Tenant B They wanted to move sub1.company.com to Tenant B (obviously need to remove all the use of the domain first) so I also repro'd this using test tenants then moved it

I literally did this on Friday as a test (and then moved the subdomain to the original tenant). I took screencaps, PM me if you want them.

Edge profiles as said, and also install teams as a web app, allow notifications then you can have two teams on the go too

Ive done something similar and I think with pretty much the rule. IME a transport rule will take 15 mins to take effect. Id probably look to see if another rule is stopping this being processed, then focus it on one email address rather than a group to see whatsup.

Assuming you mean Azure AD registered. If a client PC was using them and you have deleted them I think you'd get the client PCs popping a 'there's a problem with your work or school settings'. However why would they be using them given tenant isnt providing services. I don't recall doing anything about them in various T2T migrations i've done so I'd be tempted to leave till the very end/ ignore completely

If the accounts teachers use to sign into the laptops are synced from on prem AD you don’t need to join the devices to on prem AD, it’ll just work.

I think, in part, it's because we're all comfortable with group policy/ SCCM and fairly rich diagnostic tools. It feels like the designers of intune have never done PC management before and it's a lot 'closer' to how you'd automate azure deployments and the like. I'd sa there are gaps in functionality and powershell scripting or fairly complex haiku is required to fill said gaps (have you tried to create your own policy templates - its utterly painful) SO I don't agree, but that said that when I'm trying to fault find why something isnt working with the crap diagnostic logs - ask me again!

I've done this, I've no idea why it's so convoluted, Im sure it was a good idea at the time $fixscript = $($env:LOCALAPPDATA + "\DeleteTeamsAutorun.ps1") $bootstrap= $($env:LOCALAPPDATA + "\BootstrapDeleteTeams.vbs") $script="Dim shell,command command = ""powershell.exe -nologo -executionpolicy bypass -File $fixscript"" Set shell = CreateObject(""WScript.Shell"") shell.Run command,0" $script | out-file -FilePath $bootstrap "start-sleep -seconds 60; Remove-ItemProperty -LiteralPath 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'com.squirrel.Teams.Teams'" | Out-File -FilePath $fixscript New-ItemProperty -LiteralPath 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'NeverTeamsOnStart' -Type String -Value "$bootstrap" -Force

I created a .intunewin packaged app as didn't readily have anywhere to store the image. Packaged app is just the image and a PS script to setup.

All the attributes are in AD just use AD powershell, e.g. ProxyAddresses holds the email addresses. Owners of groups is trickier but doable.

I vaguely recall people having issues with it not allowing you to use your own DNS provider and it had to be godaddy. I have a comercial tenant and I've just added a few Business Basic licenses which I thought were reasonable at £3.80. just finished all my migrations, moved MX record and did a google takeout of all the data for good measure. Nice to be able to do the day job without faff of change request :-)

This script will achieve what you want, I'm assuming the machines are logging into AzureAD, if not modify the username build. Run as a machine script and notice the plaintext password.... $tennant="school.sch.uk"$username=$($ENV:COMPUTERNAME + "@" + $tennant) $password="Pwnme123" New-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' -Name 'DefaultUsername' -Value $username -PropertyType String -Force -ea SilentlyContinue;New-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' -Name 'DefaultPassword' -Value $password -PropertyType String -Force -ea SilentlyContinue;New-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' -Name 'AutoAdminLogon' -Value "1" -PropertyType String -Force -ea SilentlyContinue;

User_ works too and is very handy

In the AdminDescription field in AD, put Group_ This will stop the group from syncing to AAD, reversing it will see if reappear. Then set a calendar reminder to nuke them completely :-)

Sounds like you've created mail enabled user rather than a mailcontact...? Or you have created some sort of DL or dynamic DL containing the contact. What does a message trace produce?

I know you said recipient policies are not in play but the guid ending 5d7 is 'disable email address generation for this mailbox'

All settings, including archive mailbox are set via AD (then synced into AAD then into exchange directory). There is no magic connection between exchange and O365, in fact it doesnt even need to be in hybrid. Take a look at this, Exchange Recipient Type Attribute Values in Active Directory - Cloudrun then dump the same values in your AD. Then do things like 'set-remotemailbox' and see what changes.

Im reading between the lines but has someone change client DNS settings to point at the ISPs DNS and not your local DNS servers? would explain both phenomena. Clients talk to your local DNS servers (presumably hosting AD domains) which then forward to ISP DNS servers.