Overview
Microsoft 365 extension provides provisioning, update, suspension, and management of accounts and services located in Microsoft 365. These include Entra ID, Exchange Online, SharePoint Online, and OneDrive.
To access Microsoft 365, Cayosoft Administrator needs connection settings to be specified. These settings are displayed in the Microsoft 365 extension in the Cayosoft Administrator console. In addition to Microsoft 365 connection settings, there are settings for the Cayosoft Administrator automation rules and web actions.
Settings
To configure the extension, in the Cayosoft Administrator console, navigate to Home > Configuration > Connected Systems Extensions. Select the extension and configure the following:
Setting name | Description |
---|---|
Extension is enabled |
Enable or disable the Microsoft 365 extension. See the Initial Configuration Wizard article section to determine which extensions can be used in your environment. |
Microsoft 365 credentials |
Specify the account to connect to Microsoft 365. IMPORTANT: If multi-factor authentication (MFA) for the Microsoft 365 connection account is enabled with Conditional Access Policies, Security Defaults, or legacy MFA, Cayosoft Administrator prompts your to complete additional configuration steps. Microsoft 365 connection account should hold the Global Administrator role in Entra ID and must be a cloud-only account, i.e. not synchronized with on-premises Active Directory. To replace membership in the Global Administrator role with a set of more granular roles, see the following article: Permissions required for Active Directory and Microsoft 365 accounts used by Cayosoft Administrator. |
Entra ID application consent |
The Cayosoft Administrator Service uses the Microsoft Graph API to access analytical Microsoft 365 data and manage Microsoft 365 objects. To access the Microsoft Graph, you must grant administrative consent to Cayosoft Administrator.
Consent status values:
For details, see these articles: |
Microsoft 365 name suffix |
Change the Microsoft 365 name suffix. The default value for the Microsoft 365 name suffix is taken from the Microsoft 365 connection account. Microsoft 365 name suffix is used in the AD Users | Create Office 365 Accounts (Cloud) rule when creating new Microsoft 365 user accounts and in the New User web action. |
Default Usage Location |
Specify the usage location to be set by default for any newly created Microsoft 365 account, or when a Microsoft 365 license is assigned for the first time. The default setting value depends on the region of the computer running the Administration Service. The value of this setting is used in the New User | Create Office 365 User rule, when creating a new Microsoft 365 account that matches the user created in the Active Directory. |
Maximum returned results | The maximum number of objects returned from Microsoft 365. By default, all objects that you have provisioned in Microsoft 365 are returned. |
Connect to Microsoft Teams |
Set the setting to Yes if you plan to use Teams rules and web actions. NOTE: If you don't plan to use automation rules and web actions listed above, it is recommended to keep this setting set to No for optimal performance. |
Connect to SharePoint Online service |
IMPORTANT: SharePoint Client-Side Object Model (CSOM) and SharePoint Online Management Shell are required to enable this feature. For more information, see the following article: How to manually install required components to work with Microsoft 365 Services: Exchange Online, SharePoint Online, Teams Online. The Connect to SharePoint Online setting works as follows:
|
You can manually specify the SharePoint tenant admin URL and SharePoint my site host URL. These URLs are calculated based on Microsoft recommendations. If the URLs in your environment don't meet recommendations and are calculated incorrectly you should specify them manually. NOTE: Contact Cayosoft support before changing the default value. One of the following values can be used to get the SharePoint site:
|
|
SPO tenant admin URL SPO my site host URL SPO get site method |
|
Azure Environment |
Select your Azure environment from the list. For additional information on various Azure environments, see Microsoft 365 endpoints. |
License Cache File |
The license cache file contains the list of all Microsoft 365 licenses and options in your tenant. The Cayosoft Administrator Service updates this file automatically on the service start. When new licenses or services are added or removed in your tenant, click the Update License Cache button to update the license cache file manually. For details, see the following article: How to update license cache and rules when the Office 365 license change detected. |
Microsoft 365 API URL (Advanced) |
This setting points to the Microsoft 365 API endpoint and depends on the selected Azure environment. NOTE: This setting was introduced for advanced troubleshooting purposes. Please contact Cayosoft if you believe this setting needs to be changed in your environment. |
Microsoft Graph Reporting API URL (Advanced) |
This setting points to the Microsoft Graph API endpoint. NOTE: This setting was introduced for advanced troubleshooting purposes. Please contact Cayosoft if you believe this setting needs to be changed in your environment. |
Dynamic Group target exclusions |
Use this setting to prevent selecting specific groups as Dynamic Group targets to prevent escalation. You can set multiple values separated by ";", each value is a mask for the target group name. Example: *Global Admins*;*Helpdesk Admins* |
Microsoft Teams membership enumeration page size | Specify an integer number. |
Apply fix for Get-FormatData error |
Contact Cayosoft support if you receive the error connecting to Microsoft 365: Data returned by the remote
|
MS Graph advanced queries | Enables consistency level eventual which uses an index that might not be up-to-date with recent changes to the object. Use legacy EXO commands Microsoft provided a new set of commands based on REST API for managing Exchange Online. The recommendation is to use these newer Microsoft commands, but they might cause certain backward compatibility issues. Select Yes to switch back to the legacy commands. |
Delay between mailbox and permission update | Sets a delay to separate mailbox and permissions updates. The default value is 20. |
Entra ID application (client) ID | The field contains the application (client) ID of the Cayosoft Administrator API Access application in your tenant. Contact Cayosoft Support if you need to update or set the application ID. |
You can limit the scope of Microsoft 365 web queries to the members of the specified Entra ID Administrative Unit. Click Configure to see the list of all Entra ID Administrative Units in your tenant and check which of them are set to treat as containers. In this case, selected Entra ID Administrative Units will behave like Active Directory Organizational Units: when a new member is added to this Entra ID Administrative Unit, the Cayosoft Administrator removes this member from all other Entra ID Administrative Units marked as containers. You can check\uncheck Treat as container setting for each Entra ID Administrative Unit. |
|
Entra ID Administrative Units | |
Cayosoft Administrator can automatically generate user DisplayName and User Name during user creation.
Select a generation rule from the list or create your own generation rule to satisfy the requirements and policies of your organization. These rules are applied to the New User and Rename User web actions. |
|
Display Name generation rule User Name prefix generation rule |
|
User Name conflict resolution |
The naming attributes must be unique in Microsoft 365. Cayosoft Administrator provides automatic name uniqueness check and conflict resolution. A unique name can be generated with alternative generation rules and uniqueness checks applied. Select the desired behavior when a name conflict is identified:
See the following section for the alternative generation rules. For more information, see the following article: Attribute policies. |
If the Name conflict resolution option is set to Try alternative generation rule, and if fail-stop and notify a user or Try alternative generation rule, and if fail - continue and suffix the user name with a numeric counter, Cayosoft Administrator will use Alternate Name Generation Rules to generate user name during user creation. Select a generation rule from the list or create your own generation rule to satisfy your organization's requirements and policies. |
|
Alternative User Name prefix generation rule | |
Counter format |
If the Name conflict resolution option is set to Continue and suffix the user name with a numeric counter or Try alternative generation rule, and if fail - continue and suffix the user name with a numeric counter, the next available numeric counter will be added to the generated string. By default, the counter starts with 1. If you want to customize the counter format, use this setting to define the new format. For example, if you need to use two digits in the counter, you should enter 00 in the Counter format field. |
The values of default user language and time zone settings are used by default in the New User | Office 365 Mailbox post creation tasks rule. | |
Default user language Time Zone | |
Show email prefix and suffix controls | Specify if email prefixes and suffixes should be displayed when creating resource mailboxes. |
Password policy provides granular control over password complexity rules:
NOTE: Prevent sequence of UserID characters in the password policy using the UserPrincipalName prefix as UserID. |
|
Password policy | |
Specify prices for Microsoft 365 licenses, available in your tenant. You should input monthly cost - user/month. These prices are used in:
NOTE: Prices for Office 365 License Quota dashboard need to be specified on each web query separately. |
|
License prices | |
If you want to use the New Suspend functionality you should set the Use modern suspend rules and configurations setting to Yes. |
|
Default M365 User Suspend Configuration | |
Default M365 User Undo Suspend Configuration |
Each Suspend Configuration has a number of settings that are split into sections and should be customized based on your requirements. Here is the list of M365 Suspend Configurations with links to corresponding documentation articles: |
Actions
Command name | Description |
---|---|
Check Settings |
This command validates the specified settings and verifies the following:
|
Run Components Check | This command runs the Cayosoft Administrator System Check tool that verifies what required components are installed. |
Update License Cache | This command updates the list of Microsoft 365 License plans and options that are present in your Microsoft 365 tenant. For details please see this KB article: How to update license cache and rules when the Office 365 license change detected. |
Copy Consent URL | This command copies the consent URL into the clipboard so that you can paste it into any browser to grant consent directly. |
Troubleshooting Microsoft 365 connection issues
- How to grant admin consent to Azure APIs and connect to the Microsoft Graph API
- Cayosoft Azure Admin Consent for Microsoft Graph API Assignment Details
- KB20180503-1 Troubleshooting connection to Microsoft 365
- KB20180823-1 Troubleshooting Cayosoft Administrator Grant Consent
Change History
Version | Notes |
---|---|
12.2.0 | The Connect to Microsoft Online Data Service, Enforce license precedence, and License add-ins services IDs settings have been removed. |
12.1.0 | The naming has been updated. |
11.1.0 | Copy Consent URL command has been added. |
10.3.0 |
|
10.2 | Show email prefix and suffix controls setting has been added. |
10.1 |
|
9.1.0 | The Password Generation Options section has been added. |
8.2.0 |
|
8.0.0 | The Azure AD Administrative Units section is added. |
7.3.0 | Dynamic Group target exclusions, and Apply fix for Get-FormatData error settings are added. |
7.1.0 |
|
7.0.0 |
The Update License command is renamed to Update License Cache. |
6.2.0 |
Azure Admin consent status values added. |
Comments
0 comments
Please sign in to leave a comment.