moddemodocs.blob.core.windows.netmoddemodocs.blob.core.windows.net/resources-prod... · web...

Administering SharePoint Online Deep Dive Demo Guide

This document is provided “as-is”. Information and views expressed in this document, including URL and other Internet Web site references, may change without notice. You bear the risk of using it. This document does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this document for your internal, reference purposes.

© 2015 Microsoft. All rights reserved.

2

Demo Guide Administering SharePoint Online

Contents

Before You Begin........................................................................................................................................................... 6Demo home page and login........................................................................................................................................ 6Supporting Demo Files................................................................................................................................................ 6First-time Post-Install Steps........................................................................................................................................ 6Pre-demo Setup Steps................................................................................................................................................ 7

Open AdminPowerShellCmdlets.txt script file..........................................................................................................7SharePoint Online Management Shell: Startup and Connection..............................................................................7Connect to your tenant as ADMIN............................................................................................................................ 8Connect to your tenant as GARTHF......................................................................................................................... 8Open demo files (SiteColleciton.csv, GroupsAndPermissions.csv, Users.csv, and UsersAndGroups.ps1)................8Confirm Sensitive data case content.......................................................................................................................9

Administering SharePoint Online, Office 365 Video, and Delve...................................................................................10Scenario.................................................................................................................................................................... 10Goals......................................................................................................................................................................... 10Products Featured..................................................................................................................................................... 10Intended Audience.................................................................................................................................................... 11Length...................................................................................................................................................................... 11

Demo Steps................................................................................................................................................................. 12External Sharing....................................................................................................................................................... 12

Enable External Sharing........................................................................................................................................ 12View Sharing settings (Shared with External Users, or Private).............................................................................15

Site Collection Administration................................................................................................................................... 16Review and Perform Common Admin Tasks..........................................................................................................16Introduction to the SharePoint Online Management Shell.....................................................................................18

3


Create New Site Collections with PowerShell.........................................................................................................20Delete and Restore Site Collections....................................................................................................................... 22Resource and Storage Management...................................................................................................................... 24

User Administration.................................................................................................................................................. 27Manage User Profiles and Properties in the Browser.............................................................................................27Manage Users and Groups with PowerShell...........................................................................................................30Automate Group and User Provisioning with PowerShell.......................................................................................32Remove Users from a Group with PowerShell........................................................................................................33User Reports.......................................................................................................................................................... 34

Delve Administration................................................................................................................................................ 36Office 365 Video Administration............................................................................................................................... 37Information Protection.............................................................................................................................................. 38

Compliance Center................................................................................................................................................ 38Permissions........................................................................................................................................................... 39eDiscovery............................................................................................................................................................. 40Data Loss Prevention (DLP)................................................................................................................................... 42Information Rights Management........................................................................................................................... 44Enable Multi-factor Authentication for Office 365..................................................................................................46

Reset Instructions........................................................................................................................................................ 48Post-Install Steps......................................................................................................................................................... 49

Install SharePoint Online Management Shell.........................................................................................................49Download Demo Files............................................................................................................................................ 50Update AdminPowerShellCmdlets.txt.................................................................................................................... 50Update SiteCollection.csv file................................................................................................................................ 51Update GroupsAndPermissions.csv file.................................................................................................................. 51Update Users.csv................................................................................................................................................... 51Update UsersAndGroups.ps1................................................................................................................................. 52

4


Confirm Sensitive data case.................................................................................................................................. 52Set Site Collection Storage Management to Manual..............................................................................................53

5


Before You BeginYou need specific demo-related information before completing the setup steps. For convenience, you may wish to store the URLs and login credentials in a Notepad session.

Demo home page and login

Office 365 tenant: https://<Tenant>.sharepoint.com/sites/contoso User names: admin@<Tenant>.onmicrosoft.com, garthf@<Tenant>.onmicrosoft.com Password: Your password can be located within the details section of your tenant on

demos.microsoft.com

Supporting Demo Files

This demo uses five files available on the Resources tab on the Microsoft Office Division Demos site. See Download Demo Files.

1. AdminPowerShellCmdlets.txt - contains all PowerShell code used in this demo and in some Pre-demo Setup Steps.

2. GroupsAndPermissions.csv - data used by UsersAndgroups.ps1 file to create Groups in multiple site collections in User Administration demo.

3. SiteCollection.csv – data used to create multiple site collection in the Site Collection Administration demo.4. Users.csv – data used by the UsersAndGroups.ps1 to add multiple users to multiple groups.5. UsersAndGroups.ps1 – PowerShell code that uses GroupsAndPermissions.csv and Users.csv data to

programmatically create new groups and add users to those groups.

First-time Post-Install Steps

If this is the first time you are using the demo environment, complete the Post-Install Steps at the end of this document.

6

https://www.microsoftofficedemos.com/#resources

https://demos.microsoft.com/


Pre-demo Setup Steps

The following steps are required prior to each presentation of the demo.

Open AdminPowerShellCmdlets.txt script file

NOTE: If you have not downloaded demo files or prepared the AdminPowerShellCmdlets.txt file for the demo, see Post Install steps.All cmdlets used in this demo are available in the AdminPowerShellCmdlets.txt. You can open this file in Notepad and copy the necessary scripts from the file during the demo, and then paste them at the PowerShell prompt.

1. In File Explorer, navigate to the Administering SharePoint Online folder you downloaded and updated in Post-Install Steps.

2. Double-click AdminPowerShellCmdlets.txt file to open in Notepad.

SharePoint Online Management Shell: Startup and Connection

1. Navigate to the SharePoint Online Management Shell location.2. Right-click SharePoint Online Management Shell, and then click Run as administrator.3. If a User Access Control dialog box displays, click OK to allow the program to make changes.4. Navigate to the AdminPowerShellCmdLets.txt file opened in Notepad.5. Copy the entire Set-ExecutionPolicy Bypass cmdlet, and in SharePoint Online Management Shell, right-

click at PowerShell prompt, and then click Paste.6. Press ENTER.7. When prompted to change the Execution Policy press Y, and then press Enter.8. In the AdminPowerShellCmdLets.txt file, copy the entire Connect-SPOService cmdlet including URL, and in

SharePoint Online Management Shell, right-click at PowerShell prompt, and then click Paste.9. Press Enter.10. At the login screen, in the Password text box, type your Password, and then press Enter.11. When the PowerShell prompt returns, the SharePoint Online Management Shell is connected to your SPO

tenant.12. Keep the window open for use later in the lab.

7


Connect to your tenant as ADMIN

This demo begins in the SharePoint admin center, logged in as the Admin. 1. In Edge, log in to the Office 365 admin center location using these credentials.

URL: https://portal.office.com/admin/default.aspxUser name: admin@<tenant>.onmicrosoft.comPassword: Your password can be located within the details section of your tenant on demos.microsoft.com

2. Open a new tab in the browser and navigate to the Contoso site at https://<tenant>.sharepoint.com/sites/contoso.

Connect to your tenant as GARTHF

1. Open an In Private session of Edge and log into the Office 365 tenant with the following credentials:URL: https://<tenant>.sharepoint.com/sites/contosoUser Name: Garthf@<tenant>.onmicrosoft.comPassword: Your password can be located within the details section of your tenant on demos.microsoft.com

Open demo files (SiteColleciton.csv, GroupsAndPermissions.csv, Users.csv, and UsersAndGroups.ps1)

This demo uses three text files, SiteCollection.csv, GroupsAndPermissions.csv, and Users.csv, and a script file, UsersAndGroups.ps1, to automate creating multiple site collections, and provisioning groups and users. You will show the data in the .csv files and the script file during the demo, so you need to open them now and have them ready for showing.

1. In File Explorer, navigate to the Administering SharePoint Online folder you downloaded and updated in Post-Install Steps.

2. Double-click the three .csv files and the .ps1 file to open them: SiteCollection.csv, GroupsAndPermissions.csv, Users.csv, and UsersAndGroups.ps1.NOTE: Double-clicking .csv files will typically open them in Excel. You can right-click the .csv files, and select to open them with Notepad.

8




Confirm Sensitive data case content

1. Navigate to Internet Explorer browser session logged in as Admin in the Office 365 admin center.2. In Office 365 admin center left navigation, click Compliance.3. In the Compliance Center left navigation, click eDiscovery.4. Under Case name, confirm Sensitive Data Audit Q3 case exists.

a. If the Sensitive Data Audit Q3 case does not exist, see Post Install Steps.b. If the Sensitive Data Audit Q3 case exists, click it, and then click Edit (pencil icon).

5. On the Sensitive Data Audit Q3 case page, under Search and export, confirm Sensitive Data Q3 is displayed.

a. If you do not see Sensitive Data Q3, see Post Install Steps.

9


Administering SharePoint Online, Office 365 Video, and DelveScenario

In this demo, you will modify the external sharing options for your tenant. You will then navigate to the site collection as Garth Fort and walk through sending an anonymous Guest Link for a document.You will then perform site collection, user, and group tasks through the user interface, and then in PowerShell.Finally, you will briefly explore some Delve, Office 365 Video, and Information Protection administration tasks.

Goals

This demo will show how to: Enable external sharing end to end. Create a site collection, manage users, and manage groups in SharePoint. Create site collections, one at a time and in bulk with PowerShell. Delete and restore a site collection and manage resources and storage with PowerShell. Perform Delve administration. Perform Office 365 Video administration. Use Information Protection administration.

Products Featured

This demo features the following applications: Office 365 admin center SharePoint Online Management Shell SharePoint admin center SharePoint Online

10


Office 365 Video Delve Compliance Center

Intended Audience

SharePoint Administrators

Length

This demo is estimated to require 30 minutes.

11


Demo StepsExternal Sharing

Enable External Sharing

Speaker Script Click StepsWith SharePoint Online, you can enable External Sharing to control how users invite people outside your organization to access content.For example, you might want certain vendors to have edit access to certain documents, or even read access to one or more sites in your SharePoint Online environment. At the tenant level, you can allow external users to accept sharing invitations and sign in as authenticated users. By default, external sharing is set to Allow both external users who accept sharing invitations and anonymous guest links.

Once you’ve enabled the External Sharing feature at the tenant level, site collection administrators can then request sharing options for their site collection(s).

IN ADMIN BROWSER SESSION1. From App Launcher, click Admin.2. In the Office 365 admin center left navigation,

under Admin, click SharePoint.3. In the SharePoint admin center left navigation,

click settings. 4. In the External sharing area, note default setting

Allow both external users who accept sharing invitations and anonymous guest links.

5. In the SharePoint admin center left navigation, click site collections.

6. Select the check box to the left of the Contoso site collection: https://<tenant>.sharepoint.com/sites/contoso.

7. In the Site Collections ribbon tab, in the Manage group, click Sharing.

8. In the sharing dialog, note that external sharing is disabled.

9. Click Allow both external users who accept sharing invitations and anonymous guest links.

12


Speaker Script Click Steps

Thus, one site collection in a tenant could have external sharing disabled while another (or others) may allow for authenticated External User or anonymous Guest Links. By default, new site collections have external sharing disabled, but you can allow users to share content externally by using authentication or sending anonymous Guest Links.

Now that I’ve enabled sharing on the tenant and for the site collection, users like Garth can share documents with anonymous users through Guest Links.

10. Click Save.NOTE: Processing the update action may take several minutes. You will see a green wait circle while the processing occurs. You can continue with the next step.IN GARTH’S BROWSER SESSION

11. In the Contoso top navigation, click Departments, and then click Sales and Marketing.

12. In the Top-Rated Documents web part, click the ellipsis for the top document and at the bottom of the preview window, click SHARE (the document

13


Speaker Script Click Stepsyou choose may differ from the screen shot).

13. In the sharing window, to the right of the invite box, click the list dropdown to view the permission options (Can edit or Can view).

14. Clear the Require sign-in check box.

14


Speaker Script Click StepsClearing the Require sign-in check box now makes this invitation an anonymous Guest Link.

15. Click Cancel.NOTE: Add names and click Share if you want to see the results of sharing.

View Sharing settings (Shared with External Users, or Private)

SharePoint Online site collections can be shared with external users or remain private. In the Office 365 admin center, you can view the Sharing Overview dashboard to see how a tenant’s Sites, Calendars, and Skype for Business are shared with External users.The Sites dashboard shows the /sites/Contoso is set to Share links and invitations.

IN ADMIN BROWSER SESSION1. To ensure you are in the Office 365 admin

center, from App Launcher, click Admin.2. In left navigation click External Sharing, and then

click Sites.3. In the Site URL list, select the Contoso site and

note the Sharing settings column set as Share links and invitations for Contoso.

4. Select the /sites/Dev URL and note Not allowed.

15


I can also set sharing for site collections through this dashboard by selecting the site collection, and then clicking Edit. Here I can force authenticated users only or allow anonymous links.

NOTE: Selecting the /sites/Dev URL will uncheck the Contoso box and check Dev.

5. In the top navigation, click Edit ( ) icon.6. Note available options to allow external users..

Site Collection Administration

Review and Perform Common Admin Tasks


Now we’ll review and perform common tasks related to SharePoint Online site collection administration. You can have only one public site collection in a tenant, but you can create up to 3000 private site collections within your tenant, depending on your tenant’s storage capacity and resources available.You can create site collections in the browser interface, which we’ll do now, or with SharePoint Online Management Shell, which I’ll show later in the demo.The site collection dialog allows you to choose a number of different settings.

I’ll call this new site collection Contoso Test.The default tenant name is already filled in for me. I can choose to add to the /sites/ or the /teams/ Web

1. At top left, click Back ( ).2. In the left navigation of Office 365 admin center,

under Admin, click SharePoint. 3. At the upper right, review the storage capacity (GB

available of) and server resources available for this tenant.

4. In the ribbon, click New, and then click Private Site Collection.

5. In the new site collection dialog, in the Title box, type Contoso Test.

16



Site area and I can give the web site a name.

Office 365 offers a number Template Selections for Collaboration, Enterprise and Publishing site collections. I’ll create a Team Site.I can also set Administrator as the default Admin, or as any employee (such as Garth Fort), but I can only enter one admin.I’ll set the Server Resource Quota to 25, but note that if I have 0 server resources available, I cannot deploy customer apps to this site collection.TIP: Always set server resources based on any solutions you may need to deploy into the site collection. Normally customers have plenty and it’s just a matter of a simple test to identify what works best – typically applying 300 server resource allocations covers the initial test and use of common solutions.

6. Beside Web Site Address, click the tenant name: https://<Tenant>.sharepoint.com.

7. Click /sites/ dropdown to note /teams/.8. To right of /sites/ drop down, in the text box, type

contosotest. 9. In the Template Selection area, click the

Enterprise and Publishing tabs to review the available templates.

10. Click the Collaboration tab, and then click the Team Site template.

11. In the Administrator box, type Admin, then click the Check Names icon. The user name should resolve.

12. In the Server Resource Quota box, type 25. 13. Click OK and note the new site being created.

Introduction to the SharePoint Online Management Shell

NOTE: The code samples used throughout this script are only samples to guide you to the correct code in the AdminPowerShellCmdlets.txt file. You can update the <tenant>, <user>, and URLs in the scripts below to match your tenant and copy the code from this script.Speaker Script Click StepsMany administrative actions you can perform in the browser you can also complete using SharePoint Online Management Shell, a lightweight client application that executes Microsoft PowerShell commandlets into your SharePoint Online environment. As you will see, PowerShell is especially useful when creating or

1. Minimize the browser and navigate to the open SharePoint Management Shell.

17


Speaker Script Click Stepsmanaging multiple site collections or users. PowerShell has powerful built-in help and discovery tools provided through cmdlets to help you learn right in the shell. For example, you can get a list of all the cmdlets that are available for SharePoint Online.

You can use the Get –SPOSite command to view a list of all site collections in your tenant.

2. Navigate to the open AdminPowerShellCmdlets.txt file and copy the Get-Command cmdlet.

3. At the PowerShell prompt, paste the cmdlet (right-click at the prompt, and then click Paste), and then press Enter: Get-Command –module Microsoft.Online.SharePoint.Powershell

4. Resize the window if needed to show the full listing.

5. At the PowerShell prompt, paste the Get-SPOSite -Detailed cmdlet, and then press Enter: Get-SPOSite -Detailed | Format-Table -AutoSize

18


Speaker Script Click StepsIn order to define the site templates for new site collections, you need to know the template codes. Again, you can view these codes right in PowerShell using Get-SPOWebTemplate.

Optional: PowerShell can export its output to files, or import contents of a file. The output is usually more detailed than the shell can display. For example, if you wanted a permanent list of site collection templates, you might use Get-SPOWebTemplate with Export-Csv to write the data to a file.

6. At the PowerShell prompt, paste the Get-SPOWebTemplate cmdlet, and then press Enter: Get-SPOWebTemplate | Select Name, Title

7. OPTIONAL: At the PowerShell prompt, paste the Get-SPOWebTemplate cmdlet, and then press Enter.Get-SPOWebTemplate | Export-Csv c:/Users/Administrator.contoso/desktop/Templates.csv

Create New Site Collections with PowerShell

Speaker Script Click StepsCreate a Single Site CollectionYou can use a single command in the SPO Management Shell to create a single site collection or create multiple site collections using a .csv file and a simple PowerShell script.In this New-SPOSite cmdlet, note:

• The URL contains the name of my SPO tenant, here it’s Test01.

1. At the PowerShell prompt, paste the New-SPOSite cmdlet, and then press Enter:New-SPOSite -Owner admin@<tenant>.onmicrosoft.com -StorageQuota 100 -Url https://<tenant>.sharepoint.com/sites/Test01 -NoWait -ResourceQuota 25 -Template EHS#1 -TimeZoneId 10 -Title "Test 1"

19


Speaker Script Click Steps• The Owner is the SharePoint user alias to which I

want to grant ownership of the new site collection, for example, garthf or admin.

Confirm site creationWhen the cmdlet completes, I am returned to the PowerShell prompt—I do not receive a confirmation of the new site collection creation. However, I can use the Get-SPOSite – Detailed to see a list of the site collections and confirm that Test01 was created.

2. At the PowerShell prompt, paste the Get-SPOSite -Detailed cmdlet, and then press Enter: Get-SPOSite -Detailed | Format-Table –AutoSize

3. In the resulting list, point to the Test01 site collection.

Optional: IN GARTH’S BROWSER SESSION4. In the browser, in a new tab, navigate to the new

site collection to see the new “PowerShell created” team site.URL: https://<tenat>.sharepoint.com/sites/Test01

Automated bulk site creation with PowerShellHaving seen how easily you can create a single site collection with one PowerShell cmdlet, I’ll now use one PowerShell cmdlet and a text file to create multiple site collections at once.

1. Maximize the SiteCollection.csv file.2. Note Owner, StorageQuota, Url,

ResourceQuota, Template, TimeZoneID, Name columns.

3. Note URLs and Template/Names.

20


Speaker Script Click StepsThe SiteCollection.csv text file provides the owner, storage quota, site collection URL, Resource Quota, Template, Time Zone and Site Collection Name for the new site collections. I’ll be creating four site collections, TeamSite01, a Blog01 blog site, a Project01 projects site, and a community site called Community01.This Import-CSV cmdlet imports the .csv file and “pipes” the data to a loop (inside the curly brackets) that reads the first line of the file as column headers. PowerShell then iterates through the remaining “records”, creating a new SPO site collection for each record and assigning properties of the site collection according to the column headers.

Now I’ll use the Get-SPOSite cmdlet to confirm the four new sites, Blog01, Project01, TeamSite01 were created.

4. Minimize the Sitecollection.csv file.5. From the AdminPowerShellCmdlets.txt file,

copy the Import-Csv cmdlet and at the PowerShell prompt, paste the cmdlet.Import-Csv C:\Users\Administrator.Contoso\Desktop\Administering SharePoint Online\SiteCollection.csv | where {New-SPOSite -Owner $_.Owner -StorageQuota $_.StorageQuota -Url $_.Url -NoWait -ResourceQuota $_.ResourceQuota -Template $_.Template -TimeZoneID $_.TimeZoneID -Title $_.Name}

6. Press Enter to run cmdlet.7. Wait for the PowerShell prompt to reappear (it

may take a minute or two).8. At the PowerShell prompt, paste the Get-SPOSite

cmdlet, and then press Enter. Get-SPOSite -Detailed | Format-Table –AutoSize

9. In the list note the newly created site collections.

Delete and Restore Site Collections

Speaker Script Click StepsWhen you delete a site collection in SharePoint Online, the site collection is moved to the Recycle Bin. URLs for site collections in the recycle bin are “still in use,” so you cannot use them when creating new site collections and they still consume the resources and storage quotas assigned to them.I’m going to use Remove-SPOSite to delete the Dev

1. At the PowerShell prompt, type or copy/paste the Remove-SPOSite cmdlet, and then press Enter:Remove-SPOSite -Identity

21


Speaker Script Click Stepssite collection, which contains some lists and a document library.Because this is a delete function, the cmdlet asks if we’re sure we want to perform the action.

As an administrator, you have 30 days to restore a deleted site collection; otherwise the site is permanently deleted.As you will see later, you can permanently delete the site collection using PowerShell if that is desired.OPTIONAL: Restore a Site Collection with PowerShellFirst, let’s use PowerShell to restore the deleted site collection.

When you do restore a site collection, all of the properties of that site collection (including content) are preserved.

https://<tenant>.sharepoint.com/sites/Dev

2. When prompted, press Y, and then press Enter to remove the site.

3. Wait for the prompt to return (it may take several minutes) and then return to your browser session. You should be in the SharePoint admin center.

4. In the ribbon, click Recycle Bin. Verify the site collection is in the recycle bin.

5. Return to the SharePoint Online Management Shell.

OPTIONAL: Restore a Site Collection with PowerShellNOTE: You may receive an error if you use the Restore-SPODeletedSite command immediately after deletion before the system indexes the change.

6. At the PowerShell prompt, paste the Restore-SPDeletedSite cmdlet, and then press Enter: Restore-SPODeletedSite -Identity https://<tenant>.sharepoint.com/sites/Dev

7. Wait for the prompt to return (it may take several minutes) and then return to your browser session.

8. Navigate to the Site Collections page in the SharePoint admin center and note the restored Dev site collection.

9. OPTIONAL: In a new browser tab, navigate to the restored Dev site collection and note the restored content.URL: https://<tenant>.sharepoint.com/sites/Dev.

10. Return to the SharePoint Online

22



Permanently delete a site collection with PowerShellIn PowerShell, you can permanently delete a site collection immediately if you need to re-use the URL or if you need to increase resource capacity. Once you remove the site collection from the Recycle Bin, all used storage resources are released and site collection storage capacity immediately increases. I’ll delete the Test01 site permanently, by first using the Remove-SPOSite cmdlet to move the site collection to the recycle bin.Now I’ll follow up with the Remove-SPODeletedSite cmdlet to permanently delete the site collection from the Recycle Bin. This step is irreversible and because this is a permanent deletion, you will get a confirmation dialog.

Management Shell. 11. At the PowerShell prompt, paste the second

Remove-SPOSite cmdlet for the Test01 site, and then press Enter: Remove-SPOSite -Identity https://<tenant>.sharepoint.com/sites/Test01

12. Press Y, and then press Enter to confirm performing action.

13. Wait for the PowerShell prompt to reappear. 14. At the PowerShell prompt, paste the

Remove-SPODeletedSite cmdlet, and then press Enter: Remove-SPODeletedSite -Identity https://<tenant>.sharepoint.com/sites/test01

15. Press Y to confirm permanently removing the site.

16. Return to the SharePoint admin center, in the site collections page. Refresh the page.

17. Confirm that the site collection test01 was removed.

Resource and Storage Management

NOTE: If you have not set the Site Collection Storage Management to Manual, complete those post install steps now.Speaker Script Click StepsYou can also use PowerShell to manage resource usage and storage quotas. Let’s start by taking an inventory of resource usage on the tenant, starting with storage. The Get-SPOSIte 1. At the PowerShell prompt, paste the appropriate

Get-SPOSite –Detailed cmdlet, and then press

23


Speaker Script Click Stepscmdlet includes StorageQuota and StorageUsageCurrent tags.

Because screen size in the PowerShell window is limited, we displayed only a few site collection properties. To generate a more detailed report exported to a text file, you can use the Get-SPOSite -Detailed cmdlet with the Export-CSV tag.Storage for SharePoint Online is now based on usage, not strict allocation. By default, the Site Collection Storage Management for new SharePoint tenants is set to Auto with the ability to switch to Manual at any time through the settings option in the SharePoint admin center. Auto enables site collections to automatically pull from the available SharePoint Online pooled storage (more on pooled storage below). Your site collections only use what they need from the available pooled storage, automatically, up to whatever the current maximum system limit is per site collection—currently 1 TB.Choosing a Manual override allows the tenant admin

Enter: Get-SPOSite –Detailed | Select url, StorageQuota, StorageUsageCurrent | Format-Table –Wrap -Autosize

NOTE: Your results may not exactly match the screen shot.

2. At the PowerShell prompt, paste the Get-SPOSite cmdlet to Export-CSV, and then press Enter: Get-SPOSite –Detailed | Select * | Export-CSV c:\SiteCollectionData.csv

24


Speaker Script Click Stepsto set usage limits on a per site collection level.Whether you select “Auto” or “Manual,” managing SharePoint Online quota is now worry free. You don’t have to think about management overhead or “lost” storage you’ve allocated but have not used. Furthermore, you can create as many site collections as you want without worrying if you have enough storage available to allocate.I can use the Set SPOSite to change StorageQuote and StorageQuotaWarningLevel.

Let me confirm the change.

Let’s now look at the tenant resource quota and resource usage and quota.NOTE: Your results may not exactly match the screen shot.

3. At the PowerShell prompt, paste the Set-SPOSite cmdlet, and press ENTER:Set-SPOSite –Identity https://<tenant>.sharepoint.com/sites/project01 -StorageQuota 1000 -StorageQuotaWarningLevel 750

NOTE: The cmdlet may take a minute or so to complete. Wait for the prompt to reappear before moving on.NOTE: Issues have been noted where manually adjusting quota based on usage generates errors. See SharePoint Online simplifies storage management for more information.

4. Confirm the change: at the PowerShell prompt, paste the appropriate Get-SPOSite cmdlet and then press Enter:Get-SPOSite –Detailed | Select url, StorageQuota, StorageUsageCurrent | Format-Table –Wrap -Autosize

5. At the PowerShell prompt, paste the appropriate Get-SPOSite cmdlet and then press Enter.Get-SPOSite –Detailed | Select url, ResourceQuota, ResourceUsageCurrent | Format-

25

http://blogs.office.com/2014/08/18/sharepoint-online-simplifies-storage-management/

http://blogs.office.com/2014/08/18/sharepoint-online-simplifies-storage-management/



OPTIONAL: In the same way as for storage usage, you can use the Set-SPOSite cmdlet to increase the resource quota and set a warning level for the /project01 site collection.

Table –Wrap -Autosize

6. OPTIONAL: At prompt, paste the appropriate Set-SPOSite cmdlet to set ResourceQuota and ResourceQuotaWarningLevel.Set-SPOSite –Identity https://<tenant>.sharepoint.com/sites/project01 -ResourceQuota 50 -ResourceQuotaWarningLevel 40

User Administration

Speaker Script Click StepsSharePoint Online Administrators can use PowerShell to manage user and group properties in bulk. First, I’ll show how to manage user profiles and properties in the browser, then use PowerShell to manager users and groups, automate group and user provisioning, and remove users from a group.

TALKING POINTS ONLY

26


Manage User Profiles and Properties in the Browser

Speaker Script Click StepsClicking About Me redirects a user to the Delve experience. Here, Garth has quick access to his personal information in a simple Profile view showing his biography, Contact information, and Organization. The Activity tab displays panels of the content Garth has modified.A user’s Profile information on the About Me page data is gleaned from the user’s profile managed from the SharePoint admin center. As an administrator you can, “on behalf of” users, edit their profiles in the SharePoint admin center and update their data.

IN GARTH’S BROWSER SESSION1. Maximize the browser, and in the upper right, click

the GarthF image, and then click About Me. 2. Scroll the page up and down and note Contact

info, Organization.3. Click Activity.4. Minimize Garth’s browser session.

IN ADMIN’S BROWSER SESSION5. In the tenant, from App Launcher, click Admin.6. In Admin left navigation, under Admin, click

SharePoint.7. In the SharePoint admin center left navigation, click

user profiles.8. Under People, click Manage User Profiles.9. In the Find profiles box, type GarthF, and then

click Find.10. To the right of Garth’s account name, pause on

and then click the down arrow (this is not visible until you pause to the right of the account name), and then click Edit My Profile.

27


Speaker Script Click StepsNote how I can set certain properties as Everyone or Only Me, with the latter option making the property visible on the About Me page only for that user.

I’m going to change Garth’s manager to AnneW. Remember, I’m making the change on his behalf, and this information is displayed on his About Me page within the Organizational browser.

As an administrator you can also unlock the properties so users can make additional profile edits themselves within About Me. I’ll unlock the Title property so users can change the field from their About Me page.

11. Beside the non-mapped Department field, click Everyone drop down to expand and show Only Me option.

12. In the Manager box, delete Zrinka Makovac, type AnneW, and then click Check Names icon.

13. In upper right, click Save and Close.14. In the left navigation, click user profiles.15. Under People, click Manage User

Properties.16. Pause on, and then click the down arrow to the

right of the Title property (again, this is not visible until you pause to the right of the property), and then click Edit.

17. Scroll down to the Edit Settings area.18. To unlock the property, click Allow users to

edit values for this property.

28



19. At the bottom of the page, click OK. OPTIONAL: IN GARTH’S BROWSER: show the manager name change and Edit the Profile to show he can now change his job title.NOTE: The system will need to index changes before you see them in the browser.

Manage Users and Groups with PowerShell

Speaker Script Click StepsYou can use PowerShell to manage users, groups, and permissions on a site collection.When a site collection is created, by default only the site collection administrators have access. As the administrator for a site collection, you have to manually grant users access by specifying them as owners, members, or visitors. Of course, a user that is an owner can also add other users to SharePoint groups and thus grant access accordingly.I’ll add Katie Jordan to the list of Site Collection Administrators on the Contoso Test site collection using the Set-SPOUser cmdlet.

1. At the PowerShell prompt, paste the Set-SPOUser cmdlet that reference katiej, and then press Enter:Set-SPOUser -Site https://<tenant>.sharepoint.com/sites/TeamSite01 -LoginName katiej@<tenant>.onmicrosoft.com

29



Now, I’ll add Zrinkam to the Contoso Team Site Members group.

Now let’s add some new security groups to the site collection and assign permissions to the group. For example, we might want a new group called Auditors that has View Only role.I’d like to note here, that I’ll set group properties such as permission levels later using the Set-SPOSiteGroup cmdlet.Next, I’ll add alexd to the new Auditors group.

Let’s confirm these additions were made to the tenant.

-IsSiteCollectionAdmin $true

2. At the PowerShell prompt, paste the Add-SPOUser cmdlet that references zrinkam, and then press Enter:Add-SPOUser -Group “Contoso Team Site Members” -LoginName zrinkam@<tenant>.onmicrosoft.com -Site https://<tenant>.sharepoint.com/sites/TeamSite01

3. At the PowerShell prompt, paste the New-SPOSiteGroup cmdlet, and then press Enter:New-SPOSiteGroup -Group Auditors -PermissionLevels "View Only" -Site https://<tenant>.sharepoint.com/sites/TeamSite01

4. At the PowerShell prompt, paste the Add-SPOUser cmdlet that reference alexd, and then press Enter:Add-SPOUser -Group Auditors -LoginName alexd@<tenant>.onmicrosoft.com -Site https://<tenant>.sharepoint.com/sites/TeamSite01

IN THE ADMIN’S BROWSER:5. Navigate to

https://<tenant>.sharepoint.com/sites/contosotest.

6. Click Settings (gear icon at the upper right), and then click Site settings.

7. Under Users and Permissions, click People and

30


Speaker Script Click Stepsgroups.

8. In the left navigation, under Groups, click More.9. Click Auditors.10. Note the new group and user.

Automate Group and User Provisioning with PowerShell

Speaker Script Click StepsLet me show you how to automate bulk Group and User Provisioning with PowerShell. I’lll use a script and a couple of text files to add users and groups to multiple site collections.The GroupsAndPermissions.csv file contains the data for the Site Collection, the different Groups and their permission levels. The Users.csv file contains the Groups, Login Names and Site.The UsersAndGroups.ps1 file is a simple PowerShell script that will import the two CSV files and provision the site collections. We will now run the script to add users and groups to

1. Maximize the GroupsAndPermissions.csv file and note columns used: Site, Group, Permission Levels.

2. Maximize the Users.csv file and note columns used:

3. Maximize the UsersAndGroups.ps1file.4. Return to the SharePoint Online Management

Shell.5. At the PowerShell prompt, paste the

UsersAndGroups.ps1 URL, and then press Enter:

31


Speaker Script Click Stepsmultiple site collections.First we see the groups listed as they are created, then we’ll see the group list repeated as users are added.Optional: Confirm successful creation of groups and users.

c:\users\Administrator.contoso\desktop\UsersAndGroups.ps1

Optional: Confirm successful creation of groups and users.

6. In the browser, navigate to the contosotest site collection, click Settings, and then click Site settings.

7. Under Users and Permissions, click People and groups.

8. In the left navigation, click More.9. Confirm that the groups Contoso Auditors,

Contoso Designers, and Contoso Project Leads were created (you previously created the Auditors group using a single PowerShell cmdlet).

10. Click Contoso Designers and confirm that Bonnie Kearney has been added to the group.

Remove Users from a Group with PowerShell

Speaker Script Click StepsNow I’ll use PowerShell to remove a user from a site collection security group.I’ll use the Get-SPOUser command to see all users in the Team Site 01 site collection, including Alex Darrow in the Contoso Auditors group.

Use the Remove-SPOUser cmdlet to remove Alex

1. At the PowerShell prompt, paste the Get-SPOUser cmdlet, and then then press Enter:Get-SPOUser –Site https://<tenant>.sharepoint.com/sites/Contoso Test

2. At the PowerShell prompt, paste the Remove-

32


Speaker Script Click StepsDarrow from the site collection Auditors group.

And using Get-SPOUser cmdlet again confirms the removal of Alex from the Auditors group.

SPOUser cmdlet, and then then press Enter:Remove-SPOUser -LoginName alexd@<tenant>.onmicrosoft.com -Site Remove-SPOUser -LoginName alexd@<tenant>.onmicrosoft.com -Site https://<tenant>.sharepoint.com/sites/ContosoTest -Group "Contoso Auditors"

3. At the PowerShell prompt, paste the Get-SPOUSer cmdlet, and then then press Enter: Get-SPOUser –Site https://<tenant>.sharepoint.com/sites/contosotest

4. Note Alex Darrow’s Groups listing is changed.NOTE: Your results may not match screenshot exactly.

User Reports

Speaker Script Click StepsI’ve been using a simple default PowerShell report using the Get-SPOUser cmdlet. Now I’ll generate some user reports for several site collections.To make such reports more useful, we will pipe the results to a nicely formatted text file. I’ll start the UsersReport.txt file by writing the Contoso Test users to it.

I'll open the file in Notepad so you can see additional

1. At the PowerShell prompt, paste the Get-SPOUser line, and then press Enter:Get-SPOUser -Site https://<tenant>.sharepoint.com/sites/contosotest

2. At the PowerShell prompt, paste the first Get-SPOUser cmdlet for contosotest site collection, and then press ENTER:Get-SPOUser -Site https://<tenant>.sharepoint.com/sites/contosotest | select * | Format-table -Wrap -AutoSize | Out-File c:\UsersReport.txt -Force -Width 360

33


Speaker Script Click Stepscolumns, IsSiteAdmin and IsGroup.

I can use the Append parameter to keep adding to a single report file, so be aware that the parameter –Append will add new content to an existing file.

Although I’ve created a simple report, I could combine the cmdlets into a PowerShell script. With a bit more code, I could add other information to the report, for example the site collection name above each group by adding a Get-SPOSite for each URL.

3. Open File Explorer, navigate to the c:\ drive and double-click UsersReport.txt to open in Notepad.

4. Note the additional IsSiteAdmin and IsGroup fields.

5. Close Notepad.6. Keep File Explorer open.7. At the PowerShell prompt, paste the second Get-

SPOUser cmdlet for TeamSite01 site collection, and then press ENTER:Get-SPOUser -Site https://<tenant>.sharepoint.com/sites/TeamSite01 | select * | Format-table -Wrap -AutoSize | Out-File c:\UsersReport.txt -Force -Width 360 –Append

8. At the PowerShell prompt, paste the third Get-SPOUser cmdlet for Project01 site collection, and then press ENTER:Get-SPOUser -Site https://<tenant>.sharepoint.com/sites/Project01 | select * | Format-table -Wrap -AutoSize | Out-File c:\UsersReport.txt -Force -Width 360 -Append

9. Open the file C:\UsersReport.txt in Notepad and view the updated report (your results will not necessarily match the screen shot).

34



10. Close Notepad.11. At the PowerShell prompt, paste the Get-

SPOSite cmdlet the following cmdlet, edit, and then then press Enter:Get-SPOSite https://<tenant>.sharepoint.com/sites/contosotest | format-table -Wrap -Autosize | Out-file c:\usersreport.txt -force -width 360 -Append

Delve Administration

Speaker Script Click StepsDelve is powered by the Office graph and shows users the most relevant content based on who they work with and what they’re working on. The information in Delve is tailored to each user. Delve doesn't change permissions and users will only see what they already have access to.As an admin, you need to activate the SharePoint Online service and assign users a SharePoint Online

IN GARTH’S BROWSER SESSION1. In the upper left, click App Launcher, and then

click Delve.

IN THE ADMIN’S BROWSER SESSION

35


Speaker Script Click Stepslicense before they can start using Delve. You also have to set up any other Office 365 services that Delve uses, for instance SharePoint Online, OneDrive for Business, and Exchange Online if you want attachments to show up on users' Home pages in Delve. If you set up Skype for Business Online, users can start Skype for Business Online conversations directly from Delve.The Office Graph is enabled for the entire tenant by default, but you control access to the Office graph from the SharePoint admin center.If you don't allow access to the Office graph, you disable all functionality in Office 365 that is powered by the Office graph, including Delve. Delve will be removed from the Office 365 app launcher, and users in your organization will not be able to use the document discovery capabilities in Delve.Even if you enable Delve at the SharePoint level, users can choose to not show activity by going to Sharing activity within Delve settings.

2. From App Launcher, click Admin.3. In Office 365 admin center left navigation, under

Admin, click SharePoint.4. In SharePoint admin center left navigation, click

settings.5. In Office Graph section, note options to Allow

access and Don’t allow access to the Office Graph.

IN GARTH’S BROWSER SESSION6. In Delve, in upper right click Settings (gear icon),

and then click Sharing activity.7. Note Share my activity and Don’t share my

activity.8. Click Cancel.

Office 365 Video Administration

Speaker Script Click StepsOffice 365 Video is an intranet website where people in your organization can post and view videos about executive communications or recordings of classes, meetings, presentations, or training sessions.

IN THE ADMIN’S BROWSER SESSION

1. In the SharePoint admin center settings, note 36


Speaker Script Click StepsOffice 365 Video is enabled by default and SharePoint will use Azure Media Services to stream and store videos. In the settings section of the SharePoint admin center, under the Streaming Video Service section, you can disable streaming video through Azure Media Services and disable the Video Portal.When disabled, videos are removed from the tenant and the Video icon is removed from App Launcher. As an Admin you can manage video portal and video channel permissions, create video channels, and set up spotlight channels and videos. You can also delegate channel management to others on a per channel basis.Let me show you the settings to show spotlight content, set permissions, choose design, color name.Behind the scenes, video managers can easily set the Video admin permissions for the home page, leveraging the same Active Directory powered authentication in all areas of Office 365. The Spotlight tab allows admins to showcase the top priority information Contoso wants to share with employees or the latest breaking news.

Admins can also create a channel, and using the same AD authentication governance model enable other admins to manage permissions and content for each channel.These are administration tasks to get you started. For more detailed Office 365 Video content see the Office 365 Video script available on the Microsoft Office Division Demos Resources page.

Streaming Video Services options.

2. From App Launcher, click Video.3. In upper right, click Portal Settings.

4. On Manage Video Portal page, note Video admins title and that they can manage Home page in text.

5. Note Channel admins and that they can create channels.

6. In left navigation of Manage Video Portal, click Spotlight.

7. Under Spotlight videos, click a video.8. In the resulting dialog box, select a video, and then

click OK.9. Under Spotlight channels, click the first drop

down and note available channels in list, and then click Executive Corner.

10. Click Save.11. In upper left, click Home to view changes.

37

https://microsoftOfficeDemos.com/resources

https://microsoftOfficeDemos.com/resources


Information Protection

Compliance Center

Speaker Script Click StepsThe Office 365 Compliance Center is a central hub for all information protection activities in Office 365. The Compliance Center provides administrators easy access to key content management features to govern data and services across Office 365. The management interface represents an evolving compliance offering, which will help you meet your legal, regulatory, and organizational requirements. Messaging data compliance services include Archiving mailboxes, which automatically archives messages at regular intervals, while maintaining secure access to the archived content.eDiscovery is the process of identifying, collecting and producing electronically stored information in response to a lawsuit or investigation. Here you can create and manage eDiscovery cases, which are collaboration sites used to organize information related to an eDiscovery request. We’ll investigate the eDiscovery section in further detail in a moment.Admins can also manage document deletion policies for SharePoint Online and OneDrive for Business and use Import services to managing migrating your organization’s content to Office 365.

1. From App Launcher, click Admin.2. In the Office 365 admin center left navigation,

under Admin, click Compliance.

3. In the left navigation, click Archiving.

4. In left navigation, click eDiscovery.

5. In the Compliance Center left navigation, click Retention.

6. Highlight, but don’t click Manage document deletion policies for SharePoint Online and OneDrive for Business.

7. In the Compliance Center left navigation, click Import.

Permissions

It is important to set permissions correctly in the

38


Compliance Center, so only authorized individuals are allowed to perform DLP-related operations. Previously in Office 365, individuals managing any aspect of compliance from archiving to retention were given full administrative permissions to the tenant. The Compliance Center comes with several pre-configured role groups (Compliance Administrator, eDiscovery Manager, and OrganizationManagement), each of which you can give specific permissions to edit and to add Roles and Members. This enables administrators to provide access to only those places a manager needs to access.

1. In the left navigation, click Permissions.

2. On far right, highlight Compliance Administrator section and Assigned roles.

3. In the list of permission types table, in Name column, click eDiscovery Manager.

4. Click the pencil icon above the list to edit the role group.

5. In eDisovery Manager dialog, below Roles, click + sign.

6. Click Cancel.7. Below Members, click the plus sign (+) to open

the UI for adding members to the role group. 8. Click Cancel. 9. Click Cancel again to exit the eDiscovery

Manager dialog.

eDiscovery

Speaker Script Click StepsLet’s look at eDiscovery in greater detail.The scope of eDiscovery includes, but is not limited to, emails, documents, presentations, databases, voicemail, audio and video files, social media, and web sites. Conducting an eDiscovery case used to take days or weeks, and frequently required external audit requests. With eDiscovery in Office 365, individuals with appropriate permissions can complete a query and

1. In the Compliance Center left navigation, click eDiscovery.

39


Speaker Script Click Stepsgenerate a report in just minutes.Here you can create new case searches and holds, or edit existing cases.We’ve already set up eDiscovery for the Sensitive Data Audit case.

eDiscovery comes with a number of common pre-defined and built-in sensitive information types. Sensitive Data Q3 is a precise search query for content that contains US Social Security Numbers. I can easily include another query to search content for Passport Numbers.

You can Modify the Query Scope to precisely selected sources, including an individual’s mailbox or a specific web location or server.

Now I’ll Search Everything, including SharePoint. Selecting Exchange will take time to index the mailboxes, so we won’t select that option.

Some content was discovered. Pausing on one shows a preview and some document metadata. Note the Name

2. Note, but do not click New (+ sign).3. Double-click the Sensitive Data Audit Q3 case.

NOTE: The demo steps are written to investigate an existing Search Query on a case. If Sensitive Data case is not available, pick another case that contains an existing query.The eDiscovery SensitiveDataQ3 site collection opens in a new window.

4. Under Search and Export, click Sensitive Data Q3.

5. In Query text box, highlight text.6. In Query text box, click at end of query.7. Type OR , and then press Enter.

NOTE: include spaces around the word OR.8. Copy and paste the following query into the Query

text box:SensitiveType="U.S. / U.K. Passport Number"

9. Next to Sources, click Modify Query Scope. 10. Click Select sources. 11. Click Add mailbox. 12. Click Add location. 13. Click Search Everything, and then select

SharePoint. 14. Click OK to close the Modify Query Scope. 15. Click Search.

40


Speaker Script Click StepsSSN in the Preview.

Clicking under the file type in the preview shows the URL. Note that the content is located on Katie’s OneDrive, showing that we can extend eDiscovery to OneDrive locations.

We could Export the results of the eDiscovery search, but will not do so now.

16. If not already selected, click the SharePoint tab.

17. Pause on one of the results and show the preview.

18. In the Preview, highlight the URL. NOTE: Your screenshot may not match exactly.

19. In the preview, double-click the URL fragment under the file type to show the full URL for the document.

20. Show, but do not click, the Export button. 21. Close the new browser session.

Data Loss Prevention (DLP)

It is now possible to protect content in Office 365 by configuring Data Loss Prevention policies to discover and restrict SharePoint, OneDrive, and Exchange

1. In the browser session logged in as the Admin, from App Launcher, click Admin.

2. In Office 365 admin center left navigation, under

41


content access based on document metadata.

The Contoso Patent DLP policy was created from a pre-defined template and was set up to protect information stored in SharePoint Online, OneDrive for Business, and Exchange Online.

The Contoso Patent DLP policy has two rules for sending content Outside the organization and Inside the Organization.The rule for sending a message Outside the organization is applied if two Conditions are met. The message is flagged if the message is sent Outside the organization AND contains sensitive information types about Contoso patents.Currently, the Actions are to encrypt the content and show a policy tip. Katie Jordan is also set up to receive notifications and incident reports through email including all metadata for the incident.

DLP in SharePoint Online and OneDrive for BusinessWith DLP extended to SharePoint Online and OneDrive for Business, sensitive data is better protected than ever before. We will now explore how DLP works, using the policy we just created as an example.I’ll have Garth first send an email to [email protected] who is outside of Garth’s organization. Once I’ve added AlexD’s name, a message to remove the recipient is displayed at the top of the message.

Admin, click Exchange.3. In the Exchange admin center dashboard, under

compliance management, click data loss prevention.

4. From list of policies, click Contoso Patent DLP, and then click pencil icon.

5. In Contoso Patent DLP dialog left navigation, click rules.

6. Note two rules for Outside and Inside the organization.

7. Click Sent to scope Outside the organization rule, and then click the pencil icon.

8. Explore the conditions for the rule. 9. Under Do the following note the drop downs.10. Note Actions (and explore justifications and

incident reports.11. Click Cancel to close the Rule.12. Click Cancel again to close the Contoso Patent

DLP.IN GARTH’S BROWSER SESSION

13. From App Launcher, click Mail.14. In Outlook, click New.15. On the To line, type [email protected]. Click in Add a subject and note message The

following recipient is outside your organization.

17. In Add a subject, type Sending Contoso Patent document.

42


I’ll now attach a file that contains Contoso patent information. I can attach as a file or as a OneDrive file, it doesn’t matter. Either way, Office 365 will flag the attachment with a Policy tip about sensitive information. I can click Show details and see that AlexD isn’t authorized to receive the patent content, but Garth could Override the policy.

18. In top navigation, click Attach.19. Under attachments, click My files.20. Under My files, click Contoso Patent App

150219a GF comments.docx, and then click Next.

21. Under How do you want to attach this file, click Attach as a copy.

22. Once the file is attached, in the top of the message, note the Policy tip.

23. Click Show details.24. Optional: Click Override.

Information Rights Management

When you activate Azure Rights Management (RMS), your organization can protect important data using applications and services that support RMS. Administrators can also manage and monitor protected files and emails that your organization owns. You must activate Rights Management on the Office 365 tenant and SharePoint before you can begin to use the information rights management (IRM) features within Office, SharePoint, and Exchange. Activate Information Rights Management in the tenant Activation happens through the Service Settings in the Office 365 admin center. NOTE: If Rights management is not activated, follow

IN THE ADMIN’S BROWSER SESSION1. In the Admin’s browser session, in the Office 365

top navigation, click Admin.2. In Office 365 admin center left navigation, expand

Service Settings, and then click Rights Management.

3. On the Rights Management page, click Manage. 4. If Rights managed is not already activated:

a. On the rights management page, click activate.

b. When prompted with Do you want to activate Rights Management?, click activate.

c. You should now see Rights management is activated and the option to deactivate.

43


the steps to do so.

Activate Information Rights Management in SharePoint Having activated rights management across the tenant, I’ll now activate rights management specifically in SharePoint in the SharePoint admin center.

Use IRM in the SharePoint site collectionInformation Rights Management (IRM) enables you to limit the actions users can take on download content.Let’s see how rights management works in the SharePoint site collection. First, I’ll set up IRM for the Top Rated Documents library.

I’ll activate IRM by selecting to Restrict permissions on this library on download. I want to Restrict Content Upload and Download ,so I’ll select to not allow users to upload documents that do not support IRM.

5. From App Launcher, click Admin or click Browser back button.

6. In the left navigation, under Admin, click SharePoint.

7. In the SharePoint admin center left navigation, click settings.

8. If not already enabled, in the Information Rights Management (IRM) section, select Use the IRM service specified in your configuration.

9. Click Refresh IRM Settings. You should see a confirmation message, We successfully refreshed your settings.

10. Scroll down and click OK. 11. Minimize the Admin browser session.

IN GARTH’S BROWSER SESSION1. Navigate to the Sales & Marketing tab. 2. On the Sales & Marketing home page, click Top-

Rated Documents web part title to open the library.

3. On the ribbon, click Library tab, and in the Settings group, click Library Settings.

4. Under Permissions and Management, click Information Rights Management.

5. In Information Rights Management settings, click Restrict permission on this library on

44


Let’s see IRM in action. I’ll go to the home page and select to preview a Word document. You can see that embedded content does not display, but I can open the document in Word. You may need to wait for a moment while your computer is configured for IRM. When the document opens in Word, I am warned about the Policy used to restrict content upload and download.I can change to permissions to allow individuals to Read or Change the document. I even have access to More Options to further address how people can print, copy, and access content programmatically.

download.6. In Create a permission policy title text box,

type Restrict Upload and Download.7. In Add a permission policy description, type

Policy to restrict content upload and download.

8. Under Set additional IRM library settings, click Do not allow users to upload documents that do not support IRM.

9. Click OK.10. In upper left, click Sales & Marketing to

return to the home page.11. Click the ellipsis (…) next to a Word document

and show the IRM message in preview.12. In Word Preview, click Open in Word.13. In Word, note Restrict Upload and Download

message in yellow tab.14. Click Change Permission.15. In Permissions dialog, note Read and

Change options.16. Click More Options, and note settings.17. Click Cancel.

Enable Multi-factor Authentication for Office 365

Multi-factor authentication (MFA) requires using more than one verification method and adds a critical second layer of security to user sign-ins and transactions. MFA works by requiring any two or more of the following verification methods when accessing services, team

IN THE ADMIN’S BROWSER SESSION1. In Office 365 top navigation, click Admin.2. In Office 365 admin center left navigation, click

Users, and then click Active Users. 3. At top of page, beside Set Multi-factor

45


sites, OneDrive for Business.

Something you know (typically a password) Something you have (a trusted device that is not

easily duplicated, like a phone) Something you are (biometrics)

The security of multi-factor authentication lies in its layered approach. Compromising multiple authentication factors presents a significant challenge for attackers. Even if an attacker manages to learn a user's password, it is useless if the attacker does not also possess the trusted device. Conversely, if the user happens to lose the device, the finder of that device will not be able to use it unless he or she also knows the user's password.

authentication requirements, click Set up. 4. Check the box next to Alex Darrow. 5. On the right, under quick steps, click Enable. 6. Show the pop-up. 7. Optionally, click deployment guide link and

show the information. 8. Click cancel. 9. At the upper left, click the left-arrow to return to

the Office 365 admin center.

46


Reset InstructionsFollow these steps to reset the demo at the conclusion of each presentation.Reset Garth’s Profile

1. From App Launcher, click Admin. 2. In the Office 365 admin center left navigation, click SharePoint.3. In the SharePoint admin center left navigation, click user profiles.4. Under People, click Manage User Profiles.5. In the Find profiles box, type GarthF, and then click Find.6. Click the down arrow to the right of Garth’s account name, and then click Edit my profile.7. In Manager text box, change AnneW back to ZrinkaM.8. In upper right, click Save and Close.

Reset Job Title Property1. In the left navigation of Garth’s profile, click user profiles.2. In the People area, click Manage User Properties.3. Pause on, and then click the down arrow to the right of the Title property (again, this is not visible until you

pause to the right of the property), and then click Edit.4. Scroll down to the Edit Settings area.5. To lock the property, remove the check from Allow users to edit values for this property.

6. Click OK.

47


Disable External Sharing.1. In SharePoint admin center left navigation, click settings.2. Scroll to External Sharing and select Don’t allow sharing outside your organization.3. Click OK.

Delete and remove site collections1. Use Remove-SPOSite -Identity URL –nowait –Confirm Y cmdlet to move these site collections to the

Recycle Bin: Blog01 Community01 ContosoTest Project01 TeamSite01Example: Remove-SPOSite -Identity https://<tenant>.sharepoint.com/sites/Blog01 –nowait

2. Use Remove-SPODeletedSite -Identity URL–Confirm N cmdlet to permanently delete site collections from the Recycle Bin:Example: Remove-SPODeletedSite -Identity https://<tenant>.sharepoint.com/sites/ Blog01

Post-Install StepsComplete the following post-install steps once for your demo environment.

Install SharePoint Online Management Shell

To use PowerShell, you will need to download and install the SharePoint Online Management Shell, which contains a Windows PowerShell Module to manage SharePoint online.

1. Open Internet Explorer and browse to: http://www.microsoft.com/en-us/download/details.aspx?id=35588.

2. In the Microsoft Download Center click the Download button. 3. Select the 64-bit option titled sharepointolinemanagementshell_64bit.msi, and then click Next.

48


4. Save the file to your desktop.5. Double click the file on your desktop to install SharePoint Online Management Shell.6. Accept all defaults.

Download Demo Files

1. In the browser session, open a new tab, and navigate to the Resources tab on the Microsoft Office Division Demos site. https://www.microsoftofficedemos.com/#resources.NOTE: You will need a Microsoft Account to access the Microsoft Office Division Demos site.

2. On the Resources tab, click AdministeringSharePointOnline.zip file.3. When prompted to open or save the file, click Save as.4. Navigate to a location to save the file, and then click Save.5. If download completed message displays, click Open folder, otherwise, navigate to the downloaded .zip file.6. Right-click AdministeringSharePointOnline.zip file, and then click Extract All.7. Extract files to a Administering SharePoint Online folder location of your choice on your hard drive.

Update AdminPowerShellCmdlets.txt

The AdminPowerShellCmdlets.txt file contains all SharePoint cmdlets used in the demo, including cmdlets used for pre-demo set up.

1. Navigate to the Administering SharePoint Online folder you copied to the demo machine.2. Double-click the AdminPowerShellCmdlets.txt file.3. Change all instances of <tenant> to your Office 365 tenant name.4. In the AdminPowerShellCmdlets.txt file, find the Get-SPOWebTemplate cmdlet and change the

Templates.csv URL to the location of the local copy of the Administering SharePoint Online folder.Example: Get-SPOWebTemplate | Export-Csv c:/Users/GarthF/desktop/Templates.csv

5. Do the same for the Import-Csv cmdlet and the URL pointing to the UsersAndGroups.ps1.6. Press Ctrl+S to save the file. 7. Close the file if desired.

49


Update SiteCollection.csv file

The SiteCollection.csv text file is used to create multiple site collections using a text file. You need to update the text file to point to your tenant and Admin account.

1. In the Administering SharePoint Online folder, right-click SiteCollection.csv, select Open With, and then click Notepad.

2. Replace <tenant> with your tenant name, for example Contoso. You can use Ctrl-H in Notepad to bulk replace faster.

3. Press Ctrl+S to save the file.4. Close the file if desired, saving changes if prompted.

Update GroupsAndPermissions.csv file

The GroupsAndPermissions.csv file is used to create Groups in multiple site collections. You need to update this file to point to your tenant.

1. In the Administering SharePoint Online folder, right-click GroupsAndPermissions.csv, select Open With, and then click Notepad.

2. Replace <tenant> with your tenant name, for example Contoso. You can use Ctrl-H in Notepad to bulk replace faster.

3. Press Ctrl+S to save the file.4. Close the file if desired, saving changes if prompted.

Update Users.csv

The Users.csv file is used to add users to a site collection. You need to update this file to point to your tenant.1. In the Administering SharePoint Online folder, right-click Users.csv, select Open With, and then click

Notepad.2. Replace <tenant> with your tenant name, for example Contoso. You can use Ctrl-H in Notepad to bulk

replace faster.3. Press Ctrl+S to save the file.4. Close the file if desired, saving changes if prompted.

50


Update UsersAndGroups.ps1

You will use the UsersAndGroups.ps1 file to import text files for User and Group automation. You need to update this file to point to the local demo files you downloaded.

1. In the Administering SharePoint Online folder, right-click UsersAndGroups.ps1, select Open With, and then click Notepad.

2. Replace URLs with the URLs of the files you unzipped to your local machine.3. Press Ctrl+S to save the file.4. Close the file if desired.

Confirm Sensitive data case

1. In your tenant, click App Launcher, and then click Admin.2. In the left navigation, under Admin, click Compliance.3. In the Compliance Center left navigation, click eDiscovery.4. Under Case name, confirm Sensitive Data Audit Q3 case exists.5. If Sensitive Data Audit Q3 case does not exist:

a. On eDiscovery case page, click New (+ icon).b. In Title text box type Sensitive Data Audit Q3.c. In URL name, type SensitiveDataQ3.d. At bottom of page click Create.e. In the new case, under eDiscovery Sets, click new item.f. In eDiscovery Set Name, type Northwind Hold.g. Beside Sources, click Add & Manage Sources.h. In the Add & Manage Sources dialog, in Location text box type

https://<Tenant>.sharepoint.com/sites/contoso/Departments/SM/NorthwindTradersi. Click OK to close Add & Manage Sources dialog.j. Click Save to close Northwind Hold case.

51


k. In the Sensitive Data Audit Q3 case, under Search and Export, click new item.l. In the Name text box, type Sensitive Data Q3.m. In the Query text box, type SensitiveType="U.S. Social Security Number (SSN)".n. Click Save, and then click Close.

Set Site Collection Storage Management to Manual

Site collection storage management is set to Auto by default, meaning you cannot complete the Resource and Storage Management portion of the demo. Manual override will allow you to set usage limits on a per site collection level.

1. In your tenant, click App Launcher, and then click Admin.2. In left navigation, under Admin, click SharePoint, then Settings.3. In Site Collection Storage Management section, select Manual.4. At bottom of page, click OK.

52