Added Files

Powershell/PowerShell-Office365Admin/MSOnline/ADGUIDToImmutableID.ps1

@@ -0,0 +1,4 @@
+# Convert AD GUID to 365 ImmutableID
+
+$adGuid = Read-Host -Prompt 'Enter Active Directory GUID to convert to ImmutableID'
+[System.Convert]::ToBase64String($adGuid.tobytearray())

Powershell/PowerShell-Office365Admin/MSOnline/BulkAddLicenceConditional.ps1

@@ -0,0 +1,22 @@
+# Bulk add a new licence to users on the basis of what licence they currently have
+#
+# This is useful for something like adding Office 365 ATP to everyone who currently has E3, for example.
+#
+
+# What licence do the users currently have?
+$existingLicence = ''
+
+# What licence are we adding?
+$licenceToAdd = ''
+
+# Import MSOnline module and connect
+Import-Module MSOnline
+Connect-MsolService
+
+# Find everyone who has the existing
+$users = Get-MsolUser -All | Where-Object {($_.licenses).AccountSkuId -match $existingLicence -and !(($_.licenses).AccountSkuId -match $licenceToAdd)}
+
+# Add the new licence
+foreach ($user in $users) {
+    Set-MSOLUserLicense -UserPrincipalName $user.UserPrincipalName –AddLicenses $licenceToAdd
+}

Powershell/PowerShell-Office365Admin/MSOnline/BulkAddLicences.ps1

@@ -0,0 +1,37 @@
+# Bulk add additional licences to a list of users where they already have a licence assigned.
+#
+# Only works where the user already has a licence assigned as assigning a licence to an unlicenced user is a different process.
+#
+
+# Where is the list of user UPN's?
+$userListPath = 'C:\Temp\UserList.txt'
+
+# What licences are we adding?
+# List of available SKUs can be obtained with (Get-MsolAccountSku).AccountSkuId
+$licencesToAdd = @('','')
+
+# Import MSOnline module and connect
+Import-Module MSOnline
+Connect-MsolService
+
+# Import list of users from file
+$users = Get-Content -Path $userListPath | Sort-Object
+
+# Add the new licence
+foreach ($user in $users) {
+    $userDetails = Get-MSOLUser -UserPrincipalName $user
+    foreach ($licenceToAdd in $licencesToAdd) {
+        if ($userDetails.IsLicensed -eq $true) {
+            if (!(($userDetails.licenses).AccountSkuId -match $licenceToAdd)) {
+                Write-Output -InputObject ('Adding Licence ' + $licenceToAdd + ' to ' + $user + '.')
+                Set-MSOLUserLicense -UserPrincipalName $user –AddLicenses $licenceToAdd
+            }
+            else {
+                Write-Output -InputObject ('User ' + $user + ' already has ' + $licenceToAdd + ' licence assigned.')
+            }
+        }
+        else {
+            Write-Output -InputObject ('User ' + $user + ' has no existing licence assigned.')
+        }
+    }
+}

Powershell/PowerShell-Office365Admin/MSOnline/BulkChangeMFASetting.ps1

@@ -0,0 +1,42 @@
+# Bulk enable or disable MFA for all users in a tenant
+#
+
+# Enable or disable MFA?
+$enableMFA = $true
+
+# Import MSOnline module and connect
+Import-Module MSOnline
+Connect-MsolService
+
+# Enable or disable MFA
+if ($enableMFA) {
+    # Create an object containing the authentication requirements
+    $authReq = New-Object -TypeName Microsoft.Online.Administration.StrongAuthenticationRequirement
+
+    # Include all relying parties
+    $authReq.RelyingParty = '*'
+
+    # Set MFA state to enabled
+    # Enabled allows connected apps to keep working until the user completes MFA set up.
+    # This can also be set to enforced which would disconnect everything immediately.
+    $authReq.State = 'Enabled'
+
+    # Set the cut off date before which registered devices should require re-connecting with MFA.
+    # Using the current date is recommended so that all previously connected devices have to be reconnected.
+    $authReq.RememberDevicesNotIssuedBefore = (Get-Date)
+
+    # Find all licenced users who do not currently have MFA enabled or enforced
+    $usersToChange = Get-MsolUser | Where-Object {$_.StrongAuthenticationRequirements.State -notmatch 'Enabled|Enforced' -and $_.isLicensed -eq $true}
+
+    # Enable MFA for those users
+    $usersToChange | Set-MsolUser -StrongAuthenticationRequirements $authReq
+}
+else {
+    # Find all licenced users who currently have MFA enabled or enforced
+    $usersToChange = Get-MsolUser | Where-Object {$_.StrongAuthenticationRequirements.State -match 'Enabled|Enforced' -and $_.isLicensed -eq $true}
+
+    # Disable MFA for those users
+    $usersToChange | Set-MsolUser -StrongAuthenticationRequirements @()
+}
+
+

Powershell/PowerShell-Office365Admin/MSOnline/BulkChangeOnlineUserUPN.ps1

@@ -0,0 +1,22 @@
+# Bulk update Online User UPNs
+#
+
+# What domain are we replacing?
+$oldDomain = ''
+
+# What are we replacing it with?
+$newDomain = ''
+
+# Import the MSOnline module and connect
+Import-Module MSOnline
+Connect-MsolService
+
+# Get all users using that domain as their UPN
+$users = Get-MsolUser -All | Where-Object {$_.UserPrincipalName -match $oldDomain}
+
+# Run through the users replacing their UPN and keeping us updated on what's going on
+foreach ($user in $users) {
+    $newUPN = $user.UserPrincipalName.Split('@')[0] + '@' + $newDomain
+    Write-Output -InputObject ('Setting UPN for user ' + $user.UserPrincipalName + ' to ' + $newUPN)
+    Set-MsolUserPrincipalName -UserPrincipalName $user.UserPrincipalName -NewUserPrincipalName $newUPN
+}

Powershell/PowerShell-Office365Admin/MSOnline/BulkDisableMFA.ps1

@@ -0,0 +1,12 @@
+# Disable MFA for all licenced users who currently have it enabled
+#
+
+# Import MSOnline module and connect
+Import-Module MSOnline
+Connect-MsolService
+
+# Find all licenced users who currently have MFA enabled or enforced
+$usersToChange = Get-MsolUser | Where-Object {$_.StrongAuthenticationRequirements.State -match 'Enabled|Enforced' -and $_.isLicensed -eq $true}
+
+# Disable MFA for those users
+$usersToChange | Set-MsolUser -StrongAuthenticationRequirements @()

Powershell/PowerShell-Office365Admin/MSOnline/BulkEnableMFA.ps1

@@ -0,0 +1,26 @@
+# Enable MFA for all licenced users who don't currently have it enabled
+#
+
+# Import MSOnline module and connect
+Import-Module MSOnline
+Connect-MsolService
+
+# Create an object containing the authentication requirements
+$authReq = New-Object -TypeName Microsoft.Online.Administration.StrongAuthenticationRequirement
+
+# Include all relying parties
+$authReq.RelyingParty = '*'
+
+# Set MFA state to enabled
+# Enabled allows connected apps to keep working until the user completes MFA set up.
+# This can also be set to enforced which would disconnect everything immediately.
+$authReq.State = 'Enabled'
+
+# Set the cut off date before which registered devices should require re-connecting with MFA
+$authReq.RememberDevicesNotIssuedBefore = (Get-Date)
+
+# Find all licenced users who do not currently have MFA enabled or enforced
+$usersToChange = Get-MsolUser | Where-Object {$_.StrongAuthenticationRequirements.State -notmatch 'Enabled|Enforced' -and $_.isLicensed -eq $true}
+
+# Enable MFA for those users
+$usersToChange | Set-MsolUser -StrongAuthenticationRequirements $authReq

Powershell/PowerShell-Office365Admin/MSOnline/BulkRemoveLicence.ps1

@@ -0,0 +1,17 @@
+# Bulk remove a licence from users
+#
+
+# What licence are we removing?
+$licenceToRemove = ''
+
+# Import MSOnline module and connect
+Import-Module MSOnline
+Connect-MsolService
+
+# Find everyone who has the licence to be removed
+$users = Get-MsolUser -All | Where-Object {($_.licenses).AccountSkuId -match $licenceToRemove}
+
+# Remove the licence
+foreach ($user in $users) {
+    Set-MSOLUserLicense –user $user.UserPrincipalName –RemoveLicenses $licenceToRemove
+}

Powershell/PowerShell-Office365Admin/MSOnline/BulkReplaceLicence.ps1

@@ -0,0 +1,21 @@
+# Bulk replace a licence for all users who have the one being replaced.
+#
+
+# What licence are we removing?
+$licenceToRemove = ''
+
+# What licence are we adding?
+$licenceToAdd = ''
+
+# Import MSOnline module and connect
+Import-Module MSOnline
+Connect-MsolService
+
+# Find everyone who has the licence being replaced
+$users = Get-MsolUser -All | Where-Object {($_.licenses).AccountSkuId -match $licenceToRemove}
+
+# Remove the old licence and add the new one
+foreach ($user in $users) {
+    Set-MSOLUserLicense –user $user.UserPrincipalName –RemoveLicenses $licenceToRemove
+    Set-MSOLUserLicense –user $user.UserPrincipalName -AddLicenses $licenceToAdd
+}

Powershell/PowerShell-Office365Admin/MSOnline/ChangeOnlineUserUPN.ps1

@@ -0,0 +1,16 @@
+# Update Online User UPN - when AD sync doesn't do it.
+
+# Import the MSOL module and connect
+Import-Module MSOnline
+Connect-MsolService
+
+# Whose UPN are we changing?
+$oldUPN = Read-Host -Prompt 'Enter user''s old UPN in the format username@domain'
+
+# What are we changing it to?
+$newUPN = Read-Host -Prompt 'Enter user''s new UPN in the format username@domain'
+
+# Change the UPN
+if (Get-ADUser -Identity $newUPN.Split('@')[0]) {
+    Set-MsolUserPrincipalName -UserPrincipalName $oldUPN -NewUserPrincipalName $newUPN
+}

Powershell/PowerShell-Office365Admin/MSOnline/CompletelyDeleteAUser.ps1

@@ -0,0 +1,9 @@
+# Delete a user and then delete the deleted user
+
+Import-Module MSOnline
+Connect-MsolService
+
+$upnToDelete = Read-Host -Prompt 'Enter UPN of user to delete in the format username@domain'
+
+Remove-MsolUser -UserPrincipalName $upnToDelete
+Remove-MsolUser -UserPrincipalName $upnToDelete -RemoveFromRecycleBin

Powershell/PowerShell-Office365Admin/MSOnline/FixDuplicateSyncObject.ps1

@@ -0,0 +1,33 @@
+# Remove a duplicate 365 account created by a faulty sync and reconnect
+# the orphaned 365 user to the AD account.
+# 
+
+# Get correct and incorrect account details
+$adUsername = Read-Host -Prompt 'Enter username for AD account'
+$msolIncorrectUPN = Read-Host -Prompt 'Enter UPN for the duplicate object in MSOL'
+
+# Connect to MS Online
+Import-Module MSOnline
+Connect-MsolService
+
+# Get AD user account
+$adObject = Get-ADUser -Identity $adUsername
+
+# Get correct UPN from AD account
+$msolCorrectUPN = $adObject.UserPrincipalName
+
+# 
+try {
+    Get-MsolUser -UserPrincipalName $msolCorrectUPN -ErrorAction Stop
+
+    Remove-MSOLuser -UserPrincipalName $msolIncorrectUPN
+    Remove-MSOLuser -UserPrincipalName $msolIncorrectUPN -RemoveFromRecycleBin
+
+    $adGuid = $adObject.ObjectGuid
+    $immutableID = [System.Convert]::ToBase64String($adGuid.ToByteArray())
+
+    Set-MSOLuser -UserPrincipalName $msolCorrectUPN -ImmutableID $immutableID
+}
+catch {
+    Write-Host 'No account found in Azure AD matching the UPN for that AD account.'
+}

Powershell/PowerShell-Office365Admin/MSOnline/ImmutableIDToADGUID.ps1

@@ -0,0 +1,4 @@
+# Convert 365 ImmutableID to AD GUID
+
+$immutableID = Read-Host -Prompt 'Enter ImmutableID to convert to Active Directory GUID'
+[GUID][System.Convert]::FromBase64String($immutableID)