Exchange

Provisioning a New Office 365 User and Mailbox from Exchange Hybrid via PowerShell

Posted on September 18, 2017 by Office 365 PowerShell

Working with many Office365 clients, I receive queries on how to go about provisioning users and mailboxes for an Exchange hybrid deployment.

To begin with, let’s assume a couple things.

  1. We have a Windows 2012 R2 member server with Azure AD Connect (AAD Connect) version 1.1.105.00 (or newer) and the Azure AD Module for PowerShell installed; and
  2. We have an Exchange 2013 CU11 (or newer) server configured for hybrid with an active O365 tenant.

Now that we’ve established a baseline, there are a couple of options to perform the task of provisioning an AD user, creating a mailbox, and assigning an Office 365 license.

  1. The first option would be to create an AD user, create an on premise mailbox, migrate the mailbox to Office 365, and assign a license; or
  2. The second option would be to create an AD user, create a remote (or Office 365) mailbox, and assign a license.

In this post, I will cover the second option simply because it includes fewer steps and attempts to avoid confusion around where the mailbox should be created.

Do not create an AD user and then go to the Office 365 portal to create a new user and associated mailbox. This method will not properly create a synchronized O365 user and mailbox.

STEP 1: CREATE USER & MAILBOX

From the Exchange server, first create the AD user with remote mailbox using one command via Exchange Management Shell (EMS or Exchange PowerShell)…

In the command above, I created the AD user in an OU named “Office 365 Users”, set the password to “EnterPasswordHere”, and will require the user to change their password at next logon. However, I did not assign an SMTP address or remote routing address assuming that the email address policies are configured to be applied as new mailboxes are created.

STEP 2: SYNCHRONIZE USER

Once the AD user and mailbox are created, the AD object must to be synchronized to O365 in order to add the user with associated mailbox in the tenant. With the new version of AAD Connect, the scheduled sync time occurs every 30 minutes. In my case, I’m not that patient and will manually force a sync to O365.

From the server with AAD Connect installed, via an elevated PowerShell console, run the following command to perform the sync to O365…

This task will synchronize all changes made to AD since the user and mailbox were created.

STEP 3: ASSIGN LICENSE

In the final step, I assign an O365 license to the newly created and synchronized user. The following commands can be run from any machine that has both Microsoft Online Services Sign-in Assistant for IT Professionals RTW and Windows Azure Active Directory Module for Windows PowerShell installed. In my case, they are installed on each server, as well as my admin workstation.

Connect to O365 via PowerShell from an elevated PowerShell console; or using Azure AD Module for PowerShell console.

Confirm the new user does not have an O365 license assigned.

This command returns unlicensed O365 users in which the “isLicensed” parameter is “False”.

The next command returns the “AccountSkuId“, or subscription license(s), of my tenant that I will use to assign to the new user.

The AccountSkuId will look something similar to “tenantname:ENTERPRISEPACK“; where “ENTERPRISEPACK” represents my Office 365 Enterprise E3 subscription. Other subscriptions will have different representations.

Before I can assign any licenses to my new user, the user must be assigned a location (or country code). Since I’m am located in the United States, I use “US” as the two letter country code for the user, using this command…

Now that I’ve set a location for the new user, I can assign a license from my associated O365 subscription, using this command…

Finally, the user can access their assigned mailbox in Exchange Online.

Outlook 2016: Remove Duplicate entries in Room Finder

Posted on April 12, 2017 by Office 365

In Outlook 2016 some users may noticed dual entries in the Room List:

The room list behavior that we see  in Outlook is by design. When we  use a Room List  for a meeting, it is stored in the  Most Recently Used entries in the registry. When we create a new meeting, we will see this MRU entry in the top of the Room Lists . The same Room List will be seen again in the drop down which is accessed from the Exchange Server/ Online.

To prevent the duplicate entries seen in the Room List, create the below registry entry with blank data to disable the  Most Recently Used  Room List in Outlook.

Path: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Preferences

Key: RoomFinderRecentRooms
Key: RoomFinderRecentRoomList

If these entry already exist just empty the values.

After Outlook Restart:

 Only single instance of the rooms list now showing! 🙂

How to force update GlobalAddressList in Office 365?

Posted on December 7, 2016 by Office 365

This post explains how to manually force and update the global address list in Office 365.

Updating the global address list requires to have the Address List Management role. By default, nobody has this role.

1. Assign the AddressList Management role

    • Login with your administrator account to the Office 365 portal.
    • Go to Exchange Admin center, Permissions and admin roles.
    • Create a new role group and assign the AddressList role.addresslistrole

2. Update the AddressList

Once you have the AddressList role assigned, you can use the powershell commands to update the address list. You will have to wait for sometime until the new cmdlets are available.

  • First thing, logon to Exchange online using PowerShell.
  • Run the command Get-AddressList and verify that it’s working. (This may take some to work after creating the role)
  • Run Set-AddressList -Identity “All users”
  • Your address book is now updated

Exchange 2010: Moving Messages to Another Working Queue on another CAS Server

Posted on September 21, 2015 by Office 365

One of my CAS Hub servers was acting up and started queuing email. I needed to move the message to another working server while I needed time to troubleshoot what was causing the queuing.

This is what I had to do.

On the non working server:

  • Create a Folder on C: called MailsExport
  • Open Exchange Management Shell and type the following:
  • Mail should start exporting.
  • Once completed Move the *.eml files to the “Exchange Server\V14\TransportRoles\Pickup” folder on the working server.
  • The new server should immediately start processing the messages.

Cannot migrate user from Exchange 2010 to Exchange Online

Posted on August 19, 2015 by Office 365

So I came across this error while migrating some accounts from On-Premise Exchange 2010 Server to Exchange Online.

Error: The subscription for the migration user [email protected] couldn’t be loaded. The following error was encountered: A subscription wasn’t found for this user.

migrationbatch

In short, there is an address conflict between the user properties of the exchange server and the synced object on Office365. Lets go back to the basics to get this fixed.

Environment: Exchange 2010 in Hybrid Mode with Exchange Online. Migrating accounts using a staged migration approach. The problematic user in Exchange Online is properly licensed.

Setup for Staged Migration.

  • Exchange Online: Stop the problematic migration batch and delete it
  • Exchange 2010: Even though the user account may show that it is a Remote mailbox or just a User Mailbox. Right click and hit Disable. (This will remove the exchange properties for the user.)
    option1
  •  option2
  • Exchange 2010: Search your Exchange database and find the user’s on-premise mailbox. This is easier if you have just 1 or 2 databases. In an enterprise environment this may be a task by itself. Open EMS and type the following:
    If the result set it too long, you may want to save the contents to a file.
    Open the file and search for the user you disabled in step 2
  • Now you need to delete the problematic user in Exchange Online. Open up PowerShell ISE and type the following:
    After supplying the Global Admin credentials and successfully logging in, do the following:
  • Now the object is not in Exchange 2010 and Exchange Online
  • Attach the user back to Exchange 2010. Open up EMS and type the following:
  • The mailbox should show up in Exchange 2010. Make sure that the SMTP address includes: [email protected] address.
  • In a  few minutes DirSync will sync the object back to Exchange Online (This depends on your DirSync time interval)
  • When the user shows up – make sure you assign the user a license in Exchange Online.
  • Start a new migration batch for the user.
  • Migration will go through as expected.

Exchange 2007: Give a user full access to all mailboxes

Posted on June 22, 2012 by Office 365 Windows

The following command will give full access to the Mailbox database including future mailboxes when they are created. Just change the name of the Mailbox Database to yours and the name to the one you wish to use

Now access to all mailboxes:

For Send As:

For Recieve As:

In exchange 2010 only you can use this command:

Make sure you have OWA enabled for the user to view the mailbox.

Mo Wasay
My name is Mo Wasay. I work with a variety of technologies and engage with the community and customers around the world. I am located in Dallas, Texas, U.S.A. I like to share my knowledge and experiences and help others who come across similar situations. My current focus is Microsoft Azure, Azure Stack and Windows Server.
View Mo Wasay, MSCS, MCITP, MCSE, VCP, ISM, CIS's profile on LinkedIn