For security reasons DTD is prohibited in this XML document

sharepoint

I am working on a large data migration project at the moment working with SharePoint Online and just had to share this issue.. it kinda got me stumped for a while…

Using SharePoint Online Management Shell I got the following error:

pshellerror

Now the error sent me off looking at my O365 permissions, I am a global admin for the tenant. I am basically trying to configure user interpretation so I can move users OneDrive data out to another tenant, so I have also checked permissions for eDiscovery etc. But thinking about it all I am trying to do at this stage is connect to the SharePoint Admin site.. and it is giving me this error.. This is odd, I have done this loads of times before…

After about an hour of banging my head against a brick wall, I managed to resolve the problem. The solution was simple, I changed my DNS servers on my client machine to point to Google DNS (8.8.8.8 and 8.8.4.4) and that was it. – it turns out the error is actually my ISP trying to offer a “DNS Help” page which is omitting the error.

Here are my findings when trying to sort out this issue that may help to explain why it happened in the first place.

  1. http://asp.net-hacker.rocks/2016/01/15/XML-parsing-problem-because-of-your-ISP.html
  2. https://stackoverflow.com/questions/13854068/dtd-prohibited-in-xml-document-exception
  3. https://blogs.technet.microsoft.com/marios_mo_betta_blog/2016/06/05/o365-powershell-error-dtd-is-prohibited-in-this-xml-document/

The 3rd option did it for me as I use Virgin Media, so thought well if I use Googles DNS this may resolve my problem.. and it did.

 

 

 

 

Advertisements

How to migrate G-Suite to Office 365

Wow, time flies when you are having fun….I can’t believe it has been 7 months since my last post.

So since January I have been really busy with numerous projects revolving largely around Office 365 and Exchange. I have picked up some useful knowledge which I will write about here in the coming weeks.

This post is dedicated to something new to me – G-Suite to Office 365 – What a ride this has been! Let me explain how I managed to get it all to hang together and get the two services to exist together during the migration and testing phases.

EMAIL Co Existence / Routing between O365 and G-Suite

This was the tricky bit, how could we get users to co-exist in different services whilst we undertake testing and migrations? There is no connector or hybrid solution like there is with Exchange. We did not want to cut over all the users at the same time – this had to be a phased migration over to Office 365. We are also using MimeCast for SPAM and Relay protection so we need Google & Office 365 to send outbound via Mimecast without any mails getting blocked. Here is how we did it:

Office 365

Office 365 needs to be forwarding mail onto a domain that G-Suite knows about and the users mailboxes need to have an alias address for office 365 to forward onto.

The steps are as follows:

  • Add Domain Domain A with MX Record
  • Add secondary email address for each user. This needs to be set to: user@domainA.com

For users that are not yet in Office 365 we need to configure the Accepted Domain as an Internal Relay in Mail Flow in Exchange Online Admin Centre

internalrelay

Then we create a connector back to G-Suite for any address that does not live in O365 yet. Doing this tells Exchange Online to send the email to the recipient over in G-Suite.

We then stumbled across another minor problem. In order for the Email Data to be migrated into the new Office 365 users mailbox, we need to activate the license. In doing this creates a Office 365 mailbox so then Office 365 thinks the user is now happily working from Office 365. “WRONG”!!! The user still lives in G-Suite until the migration is completed. So in order for the users in Office 365 to send to a user in G-Suite who’s mailbox is provisioned in O365 we have need to create another forwarder back to G-Suite until the migration is completed. How to do this in bulk is in a following section in the blog post. – Adding Contacts to Office 365.

G-Suite

G-Suite needs to have a forwarder configured that the Tenant does not have the domain registered to. If you register a domain with Google it treats all SUB domains as internal as well, so a completely new unregistered domain is required to forward any Office 365 bound mail to.

In order for Gmail to send a message to a forwarding address, the address needs to be verified. So here is a way to forward to an address that is not verified (added to the G-Suite Tenant):

You will need to apply mappings (aliases) to recipient addresses on messages received by your domain. You can map multiple individual recipient addresses (a maximum of 2,000 entries) to other addresses. An individual address can map to a maximum of twelve addresses.

This is a basic routing concept, sometimes called a virtual user table, that’s frequently used in mail routing situations to redirect mail from one address to another. By using this setting you don’t need to create individual routing settings for each address mapping.

Configure the Recipient address map setting for your domain:

  1. From the Admin console Home page, go to Appsand thenG Suiteand thenGmailand thenAdvanced settings.Tip: To see Advanced settings, scroll to the bottom of the Gmail page.

  2. At the top of the page, ensure that the top-level org is highlighted.
  3. Scroll down to the Recipient address map section, or type Recipient address map in the search box:

    If the setting’s status is Not configured yet, click Configure (the “Add setting” dialog box displays).

    ​If the setting’s status is Locally applied or Inherited, click Edit to edit an existing setting (the “Edit setting” dialog box displays).

  4. Enter a short description that will appear within the setting’s summary.
  5. Under Messages to affect, select All incoming messages or Only external incoming messages.
  6. Scroll down to Routing options, and select Also route to original destination to send a copy of the message to the new address and also deliver it to the original recipient.

    Note: If you don’t select this option, the message is only sent to the new address.

    For example, jensmith@solarmora.com is in the address map and the new address is jensmith@gmail.com. If the checkbox is checked, both jensmith@solarmora.com and jensmith@gmail.com will receive a copy of the message. If the checkbox is unchecked, then only jensmith@gmail.com will receive the message.

  7. Enter address mappings in the box.

    Each mapping must include two addresses on a single line, separated by a comma. Place the map-to address after the comma. In the following example, davidb@solarmora.com is the map-to address:

    jensmith@solarmora.com, davidb@solarmora.com
    Each address must be a complete, specific address, and is case-insensitive. An address can be mapped to multiple map-to addresses. In the following example, jensmith@solarmora.com is mapped to both michellec@solarmora.com and johnd@solarmora.com:

    jensmith@solarmora.commichellec@solarmora.com
    jensmith@solarmora.comjohnd@solarmora.com

  8. Click Add to add the mappings.
  9. When you’re finished making changes, click Add setting or Save to close the dialog box.
    Note: Any settings you add are highlighted on the “Email settings” page.
  10. Click Save changes at the bottom of the “Email settings” page.
  11. When you’re finished, click Add Setting (at the bottom of the dialog box).
  12. Click Save changes (at the bottom of the “Email settings” page) to confirm your changes.

It can take up to an hour for changes to propagate to user accounts. You can track changes in the Admin audit log.

Adding Contacts to Office 365

First of all you will need a CSV file like the one in the image below ensuring the column headers match:

externalcontacts

When you have created your list of new Contacts that you need to create you can then import these into Office 365 using the following Powershell Commands:

To Connect to Office 365 Powershell:

Import-Module MSOnline
$O365Cred = Get-Credential
$O365Session = New-PSSession –ConfigurationName Microsoft.Exchange -ConnectionUri 
https://ps.outlook.com/powershell -Credential $O365Cred -Authentication Basic 
-AllowRedirection
Import-PSSession $O365Session

To import the contacts in your CSV file:

Import-Csv c:\externalcontacts.csv|%
{New-MailContact -Name $_.Name -DisplayName $_.Name -ExternalEmailAddress 
$_.ExternalEmailAddress -FirstName $_.FirstName -LastName $_.LastName}

We then had to update all the Office 365 mailboxes to use the forwarding address to send mail back to G-Suite using the following PowerShell and CSV file:

o365forwarding

Import-CSV "C:\Temp\Users.csv" | % 
{ $_.Condition = [bool]($_.Condition -as [int]); $_  } |
 ForEach {Set-Mailbox -Identity $_.mailbox
 -ForwardingAddress $_.forwardto -Delivertomailboxandforward
 $_.Condition}

On Prem AD with NO Exchange Attributes

So when adding the mailboxes in Office 365 be default the users email addresses were the onmicrosoft.com domain. This was happening because there were no On Premise Exchange Server therefore no Proxy addresses recorded in Active Directory. We then had to add all of the email address alias’s to the proxy addresses using PowerShell. The next few commands are how we did this.

Export the SamAccount and Existing Email details

Import-Module ActiveDirectory
# Delete file if it exists
$FileName = "C:\temp\user.csv"
if (Test-Path $FileName) 
{
  Remove-Item $FileName
}
Get-Aduser -filter * -Properties * | 
Select SamAccountName,mail | export-csv $FileName

Once you have a list of users with the correct list of Alias addresses I then ran the following PoweShell to update all of the proxy addresses

GC C:\temp\user.csv | % {
Set-ADUser $_ -Add @{ProxyAddresses="smtp:$_@aliasdomain.org.uk"}
}

Implementation of Mimecast – Outbound

G-Suite

To prepare your outbound G Suite hostname:

  1. Log on to the Google Admin Console.
  2. Navigate to Apps | G Suite | Gmail | Advanced Settings.
  3. Click on the Hosts button.
  4. Click on the Add Route button.
  5. Enter a Route Name (e.g. Mimecast Outbound Host).
  6. Select Multiple Host and enter the Mimecast Outbound Hostnames for your Mimecast region. Both must be marked as primary. See the “Outbound Send Connectors section of the Mimecast Gateway page for full details.
  7. Click on the Save button.
  8. Click on the Add Route button.
  9. Enter a Route Name (e.g. Internal Sending Host).
  10. Select Multiple Host and enter the Google Apps MX Records (ASPMX.L.GOOGLE.COM. and ALT1.ASPMX.L.GOOGLE.COM).
  11. Click on the Save button.

To configure routing rules:

  1. Click on the General Settings tab.
  2. Navigate to the Routing section.
  3. Click on the Configure button.
  4. Select the Outbound option in the “Messages to Affect” section.
  5. Select the Change Route option in the Route section.
  6. Select the Route Name created in step 5 of the “Preparing Your Outbound Hostname” section.
  7. Click on the Add Setting button.
  8. Click on the Add Another button.
  9. Select the Internal | Sending option in the “Messages to Affect” section.
  10. Select the Change Route option in the Route section.
  11. Select the Route Name created in step 9 of the “Preparing Your Outbound Hostname” section.
  12. Click on the Add Setting button.

 

Office 365

  1. Log in to the Office 365 Administration Console.
  2. Select the Admin | Exchange menu item.
  3. Select the Mail Flow | Connectors menu item.
  4. Create a Connector.
  5. Complete the New Connector – Select Your Mail Flow Scenario dialog as follows:
    Field Description
    From Select “Office 365” from the drop down list.
    To Select “Partner Organization” from the drop down list.
  6. Select the Next button.
  7. Complete the New Connector – New Connector dialog as follows:
    Field Description
    Name Enter a name for the connector.
    Description Enter a description for the connector.
    Turn It On Select this option to enable the connector.
  8. Select the Next button.
  9. Select the Only When Email Messages are Sent to These Domains option.
  10. Select the ico_plus.png icon to add the recipient domains that should use this connector.
  11. Enter a value of * to route all outbound emails through us.
  12. Select the OK button.
    Connector
  13. Select the Next button.
  14. Select the Route Email Through These Smart Hosts option.
  15. Select the ico_plus.png icon to add your region’s smart hosts.
    add_smart_host.png

    Region Office 365 Account Hostnames
    Europe (Excluding Germany) eu-smtp-o365-outbound-1.mimecast.com

    eu-smtp-o365-outbound-2.mimecast.com

    Germany de-smtp-o365-outbound-1.mimecast.com

    de-smtp-o365-outbound-2.mimecast.com

    America us-smtp-o365-outbound-1.mimecast.com

    us-smtp-o365-outbound-2.mimecast.com

    South Africa za-smtp-o365-outbound-1.mimecast.co.za

    za-smtp-o365-outbound-2.mimecast.co.za

    Australia au-smtp-o365-outbound-1.mimecast.com

    au-smtp-o365-outbound-2.mimecast.com

    Offshore je-smtp-o365-outbound-1.mimecast-offshore.com

    je-smtp-o365-outbound-2.mimecast-offshore.com

  16. Select the Save button.
  17. Select the Next button.
  18. Select the following options:
    • Always use Transport Layer Security (TLS) to Secure the Connection (recommended)
    • Issued by a trusted certificate authority (CA)
  19. Select the Next button.
  20. Select the Next button.
  21. Add an Email Address of a recipient from a domain external to your organization.
  22. Select the Validate button.
  23. Select the Save button once Office 365 has successfully validated your settings.

Cloud Migrator Used for Data Migrations

Link to the 3rd Party Migration Tool:

https://cloudm.co/cloudmigrator?gclid=CjwKCAjwns_bBRBCEiwA7AVGHlIcjIAmgfI64swjBotgV_WwduBCpMhEaBjYrcruD30K1wuJPuIkERoC–wQAvD_BwE

So our experience with the Cloud Migrator APP has been interesting. Initially we started to use the Cloud Migrator Go SaaS application which was reasonably simple to configure following the guides provided by Cloud M. However we soon realised there were speed issues when moving data between G-Suite & O365.  The issues are caused by the API’s between GSuite and O365 being limited. There is nothing we or Cloud M could do to improve the migration speed between the two services.

We then switched to the Cloud Migrator App which you install on your own dedicated server On Premise – in our case we used a Virtual machine in VMWare. Once configured we were able to fire up numerous Servers to run Cloud Migrator having a number of migration batches running at the same time and our Data throughput seemed to be 4x that of the cloud Migrator Go SaaS option.

All in all the customer is now running Co Existence of Office 365 and G-Suite. Mail is flowing and users are happy. We intend to complete the migration to Office 365 in the coming weeks. I decided to write this post as there does not seem to be many guides out there to help you migrate from G-Suite to Office 365. Hopefully if you read this it will help you on your projects.

 

 

Add customised help desk info to the Office 365 help pane

Well, here is a nice little feature that I was unaware of until today…. A handy way to inform your users on support information for Microsoft Office 365.

As an Office 365 admin, you can streamline user support by adding customised contact information to the help pane. Users in need of support will be able to access your organisation’s custom support contact info with a single click of the help icon.

image

Create the custom help desk card

NOTE: To create a custom help desk card, you must be a global admin for Office 365 and have a license to Exchange Online. Learn how to assign licenses in Office 365 for business.

Create the custom help desk card in the admin center

1. Sign in to Office 365 with your work or school account. Learn how to sign in to Office 365.

2. Select the app launcher icon clip_image003 and choose Admin.

3. Choose the settings icon, and then choose Organization profile.

clip_image004

4. Next to Provide customized help desk contact info, choose Edit.

clip_image005

5. Turn on the Help desk card.

6. As an admin, you decide what kind of contact information you want to give users. The title and at least one form of contact information are required. Select what you want to display, and fill out the appropriate info.

o Custom title: Enter a title that clearly indicates your intent, like “Contoso help desk” or “Need help?”

o Help desk phone: Enter the phone number users should call to talk to a tech support agent at your organization. Be sure to include any prefixes that may be needed to complete the call.

o Help desk email: Enter the email address for your support department.

o Help desk URL: If your support department has an internal or public website with helpful tools and resources, enter its name and the associated URL.

7. Choose Save.

To see your new customized help desk card, sign out and back in again. We recommend you test the links on the card as soon as you sign back in. Your users will be able to see the card the next time they sign in.

Microsoft Release a SharePoint Migration Tool

The SharePoint Migration Tool lets you migrate your files from SharePoint on-premises document libraries or your on-premises file shares and easily move them to either SharePoint or OneDrive in Office 365. It is available to all Office 365 users.

Designed to be used for migrations ranging from the smallest set of files to a large scale enterprise migration, the SharePoint Migration Tool will let you bring your information to the cloud and take advantage of the latest collaboration, intelligence, and security solutions with Office 365.

SharePoint Migration Tool

Download and Install the SharePoint Migration Tool

You can download and install the SharePoint Migration Tool using Internet Explorer, Edge or Chrome browser.

IMPORTANT:

  • If you are using the Chrome browser, you need to install the ClickOnce for Google Chrome plug-in before installing the SharePoint Migration Tool.
  • To download and install the plug-in: Using Chrome, go to this site and then click Add to ChromeClickOnce for Google Chrome plug-in
  1. To download the tool, go to SharePoint Migration Tool.
  2. Click Install.
  3. Click Yes to allow this app.
    After downloading and installing the SharePoint Migration Tool, read How to use the SharePoint Migration Tool to help you get started.

For a video introduction and overview of how this new tool works, please see below:

 

Sharing files & folders in SharePoint & OneDrive

This is a first post in a while, hopefully I will be posting more content as the year goes on focusing on Office 365 and Azure.

For now, as more and more people move over to SharePoint i get asked how can I share my content with people who don’t necessarily work in my organisation, so hopefully the steps below will help answer this question.

Sharing files and folders in SharePoint Online / OneDrive Online couldn’t be easier. The process is similar in both products so from this point on, I will refer to both products as ‘OneDrive’.

Here’s a few key features of File Sharing in OneDrive;

  • Share files within your organisation and external users
  • Control who can view or edit the shared files
  • Work together in real time (also referred to as Co-Authoring)

File Sharing

  1. Go to OneDrive for Business or the site library that has the file you want to share.

  2. Right-click the file you want to share, and then select Get a link. If you don’t see Get a link, click Share, and then click Get a link.

    Screenshot of Sharing a document by using Get a link

Choose the type of link you want to create.

Screenshot of choosing a link

Links for internal sharing:

  • Edit link – account required After they sign in, people in your organization can edit, copy, or download the file.

  • View link – account required After they sign in, people in your organization can view, copy, or download the file.

Guest links:

  • Edit link – no sign-in required People outside your organization can edit the file and may also be able to copy and download the file. People may need to sign in with a Microsoft account to copy or download the file.

  • View link – no sign-in required People outside your organization can view the file and may also be able to copy and download the file. People may need to sign in with a Microsoft account to copy or download the file.

  1. If guest access is disabled, you’ll see only account required options.

  2. If you choose a no sign-in required link and you want to set the link to expire, click Set expiration, and then choose how long before the link expires, such as 30 days. Account required links don’t expire and there’s no option to set an expiration for those links.

    Screenshot of Setting an Expiration for a guest link

  3. Click Copy to copy the link to the clipboard.

  4. Paste the link into an email and send it or post it on a website for the people you want share with.

I hope this was easy enough to follow, if you have any questions please drop me a line.