Microsoft IT Group Management Strategies

Copyright © 2020 Cayosoft Inc.Cayosoft | The best way to manage the Hybrid Office 365 Enterprise
Microsoft Groups Demystified
Five Keys to Successful Group Management
Joel Oleson, MVP&RD
Director
Perficient
Bob Bobel
Hybrid Expert &
Cayosoft Founder
Experts
Webinar Series

Meet Joel Oleson, MVP & RD Perficient
Joel Oleson  Director Perficient
Per
First SharePoint Admin
20+ years on Collaboration & Intranets
10 years at Microsoft
Global Community Leader, Influencer & Blogger

Meet Robert & Cayosoft
Robert Bobel  Founder and Cayosoft CEO 
Following ten years of driving AD Management and Identity Management
Solutions for Quest Software (acquired by Dell® in 2012 then spun off in 2017),
Bobel joined with former colleagues and founded Cayosoft in 2013. The
company was founded with the idea to create the next generation of
management software for Hybrid and Cloud platforms.

The Challenge
Exponential growth and years of unmanaged groups
Lack of visibility & manageability of hybrid groups
Group sprawl leaving organizations vulnerable
Authorization creep massive compliance risk
Group Management Keeps Getting Kicked Down the Road
TRUTH: There are more groups than IT has resources to keep up!

Define
Define Hybrid
Management Group
Strategy for on premises
Security Groups and
Microsoft 365 Groups with
Classification
Plan
Plan Self Service or IT Led
Group Management with
Oversight
Provision
Provision Groups with
Governance and Lifecycle
in Mind Include Secondary
Owner, Location and
Department
Audit
Audit and Remediation:
Automated Periodic
Reviews with Auditing,
Ownership and Usage with
preference to Dynamic
groups.
Archive
Clean up: Archive or Delete
Obsolete Groups

Define
Define Hybrid
Management Group
Security Groups and
Classification
Plan
Oversight
Provision
Owner, Location and
Department
Audit
Automated Periodic
groups.
Archive
Clean up: Archive or
Delete Obsolete Groups
Define
Define Hybrid Management Group
Strategy for on premises Security Groups
and Microsoft 365 Groups with
Classification

Microsoft IT Pillars of Data Governance

Crucial to achieving our goals. Limited distribution—on a need-to-know basis
Daily work product used and shared throughout Microsoft, like personal settings and zip codes.
Share it throughout the organization internally.
Public data is unrestricted data meant for public consumption, like publicly released source code and
announced financials. Share it freely.
Unified Content Classification
The most critical data. Share it only with named recipients

Group Management - Day Forward
Who can
create
Microsoft 365
Groups
Security Groups
Distribution
Groups
Mail enabled
Security Groups
Naming
conventions
Prefix-suffix
naming policies,
fixed strings or
user attributes
Blocked words
Configure
guest access
Manage who can
add guest users
Turn sharing
option on or off
Configure external
sharing
Configure
expiry
Set expiration
duration
Set Attestation
Choose which
Groups policy will
apply to
Set policies
Classification
Retention
eDiscovery
Data Loss
Prevention
Dynamic
Groups
Attributes
Policies
Automation
Auditing
Zero Trust Security
Ownership
validated
Analytics
Usage
Membership
validated

Define
Define Hybrid
Management Group
Security Groups and
Classification
Plan
Oversight
Provision
Owner, Location and
Department
Audit
Automated Periodic
groups.
Archive
Plan
Plan Self Service or IT Led Group
Management with Oversight

Exchange Group Creation & Management

Azure AD Groups

Azure AD Connect Sync Status
• Excludes built-in security groups from directory synchronization.
• Does not support sync Primary Group memberships to Azure AD.
• Does not support sync Dynamic Distribution Group memberships to Azure AD.
• Will sync an Active Directory group to Azure AD as a mail-enabled group with
SMTP proxy address
• Contact object with SMTP address
• Disabled accounts
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-
sync-whatis

Microsoft 365 Admin Center

AD & Azure AD Group Management
AD
Group
SID?
Scope
Domain?
Users, Computers
& Other Groups
Dynamic Attribute
based membership
Used
for
ACLs
Is Security
enabled?
Is Mail
enabled?
Distribution
Group
No
SID
Users
SMTP
Distribution
of email
Dynamic
Shared
Mailbox
No
SID
Members
SMTP
Send As
sync

Microsoft 365 Groups (Unified Groups)
Limitations
• Can contain only users & cannot be nested
• Can be configured Public/Private
• Owner is required for Teams
• Has an email address
• Send copies of group conversations and events to
group members’ inboxes.
• Can allow outside the organization email the group
• Do not exist on-premises
• Group Membership Writeback
Integrated Applications
• Outlook
• Planner
• SharePoint
• Yammer
• Microsoft Teams
• StaffHub
• PowerBI
• Roadmap
https://docs.microsoft.com/en-us/exchange/hybrid-deployment/set-up-office-365-groups
https://docs.microsoft.com/en-us/microsoftteams/limits-specifications-teams%C2%A0Teams Limitations
Groups Limitations

Microsoft IT
How Microsoft
manages groups
Empower employees while
protecting content, keeping
compliant, and holding
employees accountable

Microsoft IT:
How Microsoft
manages groups
Empower employees while
protecting content, keeping
compliant, and holding
employees accountable

Define
Define Hybrid
Management Group
Security Groups and
Classification
Plan
Oversight
Provision
Owner, Location and
Department
Audit
Automated Periodic
groups.
Archive
Provision
Provision Groups with Governance and
Lifecycle in Mind Include Secondary
Owner, Location and Department

Planning Hybrid Groups
Who can create Groups?
Naming
Conventions?
Guest Access?
Settings &
Policies?
Approved Apps?
Email
Capability?
Security
Considerations?
https://docs.microsoft.com/en-us/MicrosoftTeams/teams-adoption-governance-quick-start

PowerShell Creating a new Group in
AzureAD
New-AzureADGroup
[-InformationAction <ActionPreference>]
[-InformationVariable <String>]
[-Description <String>]
-DisplayName <String>
-MailEnabled <Boolean>
-MailNickName <String>
-SecurityEnabled <Boolean>
[<CommonParameters>]
PowerShell cmdlets are part of the Azure Active Directory PowerShell V2 module

Graph Management Slide
Mike Ammerlan #MSBuild session from for more info.

Enabling self-service creation
Self service creation

Define
Define Hybrid
Management Group
Security Groups and
Classification
Plan
Oversight
Provision
Owner, Location and
Department
Audit
Automated Periodic
groups.
Archive
Audit
Audit and Remediation: Automated
Periodic Reviews with Auditing,
Ownership and Usage with Preference to
Dynamic Groups

Managing Ownership
You should always have
At least 2 group owners
that way when One
leaves you’ve got
One to assign others

Audit Logs and Bulk Operations

Group Membership Bulk Operations

Word
David Johnson
Donnell Brazil
Augusta Greer
Gerry Hetrick
Cathryn Barnes
Beverly Bell
Manage External collaboration:
Guests in Groups

Define
Define Hybrid
Management Group
Security Groups and
Classification
Plan
Oversight
Provision
Owner, Location and
Department
Audit
Automated Periodic
groups.
Archive
Archive
Clean up: Archive or Delete
Obsolete Groups

Configure Group Expiration
https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-lifecycle

Lifecycle management
Group owner experience of expiration policy

Enable in-product
Lifecycle
management
Microsoft enforces 180 days Lifecyle
A phased approach was adopted to
deploy this policy; we started with
cycles of 360 days and progressively
reduced the window
What you can define when setting Expiration Policies
• Set expiration timeline
• Notification intervals are set automatically
• Set fallback email address for ownerless groups
• Apply policy to selected groups
• Soon groups will be auto-renewed based on membership activity (in
Private Preview). To learn more: Monday: BRK2056 - Embrace Office 365
Groups: What's new and what's next (4:30 – 5:15)

Azure Portal Expiration

Microsoft IT Internal Best Practice

Best Practice

Group Management Reality Check!
PowerShell
Microsoft Graph API
3rd Party Tools
https://docs.microsoft.com/en-us/graph/api/resources/teams-api-overview?view=graph-rest-1.0Graph Overview

Cayosoft Group Management
DEMONSTRATION
TIME PERMITTINGDEMO TIME PERMITTINGTIME PERMITTING TIME PERMITTING TIME PERMITTING

Questions? Thank you for attending!
NEXT STEPS:
 Cayosoft.com/download
 Cayosoft.com/demo
 Cayosoft.com/question
 Cayosoft.com/free
FREE Management & Hybrid Reporting Tools
 Other Questions
sales@Cayosoft.com

Microsoft IT Group Management Strategies

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Ähnlich wie Microsoft IT Group Management Strategies

Ähnlich wie Microsoft IT Group Management Strategies (20)

Mehr von Joel Oleson

Mehr von Joel Oleson (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Microsoft IT Group Management Strategies

Hinweis der Redaktion