User Profile
Franck1304
Brass Contributor
Joined 8 years ago
User Widgets
Recent Discussions
Size of the Microsoft Purview Audit Log for sizing SIEM / Splunk Storage
Hi there, we plan to export our M365 Audit Logs into a Splunk solution. The license cost is based on the storage needed. my questions: - is there a way to assess the storage used by our Audit logs in Microsoft Purview? - is there a way to calculate the storage needed for a number of users in a give time, e.g. per day/ week for heavy, medium, low M365 usage, I only need rough numbers? - does anybody have experience or numbers of their export to a SIEM system? Any support highly appreciated. Thanks, FranckWhat is the Powershell command to configure a new Retention Policy in the Information Governance?
Hi there, I am Looking for the PowerShell command to configure a new Retention Policy in the Information Governance. I am not Looking for the PowerShell Command to apply Retention Tags, which is New-RetentionPolicy. I would like to exclude an IPM Message Class for Voice Mail, which is not possible through the UI. Thanks, FranckNew External Sharing Experience - when is a Guest account created?
hi there, we are testing the sharing configuration in OdFB and SPO. We configured "Users can invite new an existing guests". In ODfB i first share a file with user abc@outlook.com. He gets the invitation and then the access code. No Guest account is created. Then i share another document with user abc@fabricam.com which is an external O365 User. This user also gets the invitation, and then the access code. Now a Guest account is created for this user. What is the exact algorithm behind this. are Guest users only created for O365 (School and Work Accounts)? Can I prevent that Guest Users are created at all for users invited by standard users? thanks, FranckSharing documents in SPO and ODfB incorrectly resolves e-mail addresses
When I try to share a document with an external, the People Picker incorrectly resolves e-mail adresses. E.g. when I try to share with my hotmail account franckma@hotmail.com, I have not way to choose this e-mail. it always resolved to my tenant test account labadmin@imprimistest1.onmicrosoft.com. The interesting fact is, that both accounts only have the dispay name in common. Even if i use a semicolon, behind the e-mail address, it resolves immediately to the wrong address and i have not way to see this in the people picker. When it is resolved, i can only see the display name. Is this planned to be fixed?Customized RBAC Azure AD / Office 365 Admin role
Hi there, there was a discussion about this 18 month ago and I am wondering what the status is. https://techcommunity.microsoft.com/t5/Admin-Center/Can-we-create-a-custom-Office-365-Admin-Role/m-p/51902#M498 What is the possibility to create customized Azure AD Admin roles? (Not Exchange RBAC roles and not Azure Resource Admin roles in Azure AD) Thanks, FranckAIP, eDiscovery and unindexed items
After reading different posts and the comments to it, i tested if eDiscovery can find AIP protected items in SPO and ODfB. "Among other attributes, Office 365 indexes Exchange message properties including sender, recipients, message body, and attachments. Documents and messages encrypted with RMS and Azure RMS technology are also indexed and searchable." from: https://www.microsoft.com/en-us/itshowcase/office-365-meets-evolving-ediscovery-challenges-in-a-cloud-first-world However, my eDiscovery searches cannot find any word in an AIP protected document and I also get a notice that a number of documents cannot be indexed, which is the number of protected documents in my test tenant. On the other side I just read the following on: https://docs.microsoft.com/en-us/azure/information-protection/office-apps-services-support "For libraries that are not IRM-protected, if you protect a file that you then upload to SharePoint or OneDrive, the following do not work with this file: Co-authoring, Office Online, search, document preview, thumbnail, eDiscovery, and data loss prevention (DLP)." For me, this totally contradicts the above quote. What is the true story on eDiscovery, DLP and AIP protected documents? Thanks, FranckRe: Export Active directory Identity protection Risky user events to EventHub/ SIEM
I also would like to bring up this topic. After some research I found out how to stream AAD Audit logs to an Event Hub and eventually import these to a SIEM. However I can not find a way to stream Sign In and User Risk Events to an EventHub. Anybody already done this? Thanks, FranckReconnect the SharePoint site of a private channel back to the Files tab of that private channel
my users are not able to see the files of a private channel SharePoint site in the Files tab of that private channel. However the SharePoint site still exists. Is it possible to "reconnect" the SharePoint site to this private channel Files tab? also see screenshots. Thanks, FranckRe: What is the Powershell command to configure a new Retention Policy in the Information Governance?
Thanks VasilMichev , but in the New-RetentionCompliancePolicy I have no option to define the Settings of the Policy, e.g. how many years I want the Retention to be in place. It seems to me that this is defined in theNew-RetentionComplianceRule. So what is defined in a new SCC Retention Policy UI seems to be a mix of New-RetentionCompliancePolicy and New-RetentionComplianceRule? Am I correct here? The New-RetentionComplianceRule would give me the Option of excluding IPM classes. Thanks, FranckRetention label storage growth modeling and how to minimize storage growth by excluding file ext.
Hi there, has there any modeling been done at what rate OneDrive/SPO and EXO storage would grow by applying a 10 year Retention Policy to all these Services? Is this managable at all? Should I monitor it over time and Can i expect a significant growth / additional cost? Further, would it be possible to exclude Video, Audio and some other large file extensions from the retention? I could not find anything documented or on the UI but did not yet look into PowerShell possibilities... Thanks, FranckRe: Cannot edit protection templates
Lloyd AdamsCould you really rename these protection templates. I cannot rename them, it always tells me the new template name already exists, regardless what weird name i give it. Did you rename them in the UI? or with PowerShell? this is a real pain! Any help appreciated. Thanks, FranckRe: AIP, eDiscovery and unindexed items
Thanks Vasil, for your comments, unfortunately also eDiscovery in Exchange Online does not work for me. I created one additional protected document and attached it to a protected message that I sent to another user in my test tenant. So i have 3 more items: - the new document - the sent mail - the received mail. Exactly these 3 items appear as not indexed in my eDiscovery Search.Re: What is the difference between Sensitivity Labels and AIP Labels?
Apologies if I object. AIP Lables can be migrated to Unified Labels (one time copy process where the label ID is important to be preserved). Unified Labels will be synched back to AIP. Be aware that not all AIP label properties exist in Unified labels. Franck
