Go read this post first. That's what helped me figure out what to do without too much Googling around! Key things are: The URL to call (via POST) is No need for a body, unless the pipeline needs one. Here's the documentation for the URL being called (there isn't much!). The example there shows a payload, ignore that example.

The Engage Administrator role in Viva is known as Yammer Administrator in Entra ID. After assigning that, you will see that the admin is unable to create new communities, for instance. What you have to do to fix this is go to the Admin Portal in Engage itself, and add the user as a Network admin (or Verified admin; but better to start with Network admin as that's the least privilege required).

In case this helps anyone else... not saying what follows below is the solution for such errors. Started to use Zed again earlier this week, and one one of my machines it showsa warning that the environment variables failed to load. Clicking on it opens up the logs, which has a bunch of entries like these: Caused by: login shell exited with exit status: 1.

Maybe it's always been the case, or maybe it changed some time ago but I never used this connector much and so didn't realize... anyhoo, using the "Invoke an HTTP request" connector from a Logic App/ Power Automate to connect to Graph throws an error now: Reading the docs for this connector, there is a section on how to authorize it…

There's plenty of blog posts on this topic, so I won't go into the basic details. We often have admin accounts in Entra ID that must receive emails, but there's no point wasting a license on a mailbox for this. What do we do here? Easy. Use Plus Addressing. What plus addressing means is that every mailbox enabled user also has a "+<whatver>" suffix they can use as an email address.

We happened to watch “Good Fortune” this weekend. It's a blast of a movie! I had so much fun watching it. I didn’t realise it was written and directed by Aziz Ansari (his movie debut). If you like his stuff you’ll definitely enjoy this one! Very satirical and funny. The movie also ties with a lot of the books and podcasts I consume nowadays.

Continuing with SuccessFactors on Android, one of the things the app does upon launch is to ask whether you want to use a password or fingerprint. If I select "fingerprint", it says there's no fingerprint to be found. And if I select "password" I can setup a new password and use that each time I open the app. That seemed a bit inconvenient, and I was curious why it wasn't finding the fingerprint - especially coz my phone had fingerprint and face unlock setup.

We wanted to push the Android and iOS apps of SAP SuccessFactors. iOS is easy. Push the app out to a group. Also push out an app configuration so the app knows what to do when a user clicks on it. Easy peasy. This article has a list of the keys you need to push out. And you can do so via an XML file like so:

Sweet, Hammerspoon can run macOS shortcuts! So awesome. 🥳 In a similar vein to my tinkering with Hue lights... I have a BenQ ScreenBar Halo on my monitor which I'd like to turn off when I logoff or my Mac goes to sleep. The latest version of the Halo has some sensors that can detect when you are around, but I don't have that nor have any plans of buying that, so I wondered what else I can do.

"Blood in the Machine" - the book - by Brian Merchant, is crazy! I am only some 100 pages in to it so far, but it is so shocking and eye opening. I never knew this was what the beginnings of the Industrial Revolution was like. I never know this was what the Luddite movement was about. And worse, as Mark Twain said (a quote I found in this book) "History never repeats itself, but it does often rhyme" - so true!

I have an automation that goes through the Graph audit logs API output for any Conditional Access policy changes. I noticed that the output for these had a few entries that looked like "excludeGuestsOrExternalUsers":{"guestOrExternalUserTypes":63, ...} That made no sense. The valid values for guestOrExternalUserTypes should be one or more of of none, internalGuest, b2bCollaborationGuest, b2bCollaborationMember, b2bDirectConnectUser…

Just adding a link to this Microsoft blog post I previously linked to, and especially the video in it. Wanted to capture two screenshots from there. This is how enrollment works for Android phones And this is how it works for Android AOSP This puts into pictures what I saw in the logs in the previous posts. ☺️ The Company Portal app is no more.

Continuing from my previous post (which is a continuation to another post), during my last enrolment the phone OS upgraded from Android to Android AOSP. This was not unexpected because Microsoft is in the process of moving Teams phones from Android to Android AOSP. Details can be found in this blog post and my phone model's latest Android firmware is on the list of supported devices.

Continuing from my previous post, I upgraded the Yealink MP56 phone to the next available firmware. Firmware 122.15.0.107 This firmware is from December 2022. Here is what the admin page shows post-upgrade: Firmware Version: 122.15.0.107 Hardware Version: 122.1.0.0.0.0.0 Company Portal Version: 5.0.5484.0 Teams Version: 1449/1.0.94.2022110803 Admin Agent Version: 1.0.0.202209060820.product This is new, wasn't present originally. Things are a bit different now when powering on the device.

I wanted to document the authentication flow for Teams phones. This is by no means comprehensive, but only what I have been able to gather by looking at a Yealink MP56 phone. The device itself is discontinued, but firmware updates are available so it works with Teams. The device I got happened to be on a really old version of the firmware, so I was able to try it across various versions.

Continuing my trilogy (here and here) of Hue API posts... in my previous post I detailed how I set the lights to turn or or off when I login to my Mac. Slight issue with that. When I used to do this via the Hue sensor, it would set the correct scene coz the sensor was set to power on the light with a particular scene.

Barely a few days since my previous post on having fun with the Hue API, and the sensor stopped responding to my API calls. There's no error or anything, the sensor just doesn't get enabled! I run the command as before: APIKEY=$(pass apiKeys/hue) BRIDGE_IP="<ip>" SENSOR_ID="<guid>" echo "${GREEN}✨ Enabling sensor${RESET}" curl --request PUT \ --url \ --header "content-type: application/json" \ --header "hue-application-key: $APIKEY" \ --data '{ "enabled" : true }' \ --insecure…

Encountered a red-herring of an error today. A colleague shared a Power App with another colleague and got the following: The user in question was indeed enabled and licensed. Also, interestingly, the user Id in the error didn't match that in Entra ID (but then I guess it must be the Id of the object in Power Platform itself). Even though my colleague got an error, when he looks at the "Share" pane the user is added there.

Every so often I get a request from one of our IT folks asking if I can add such and such app to our App Protection policies. Thing is, most of the time the app in question isn't one that's supported by Microsoft/ Intune. (See this article for a list of supported apps). Inevitably a follow-up question is whether I can…

Playing with Functions in KQL today. One of the things I wanted to do was troubleshoot the input I am passing to a Function. Couldn't figure out a obvious way to do this, so here's what I did. My objective here is simply to see if I am even passing inputs in correctly! At this point I am very new to KQL functions so we are talking basics here.

I have a Hue sensor on my desk that turns on and off the lights on the desk when I am at it. Since my desk is in our bedroom, and I don't want the sensor to be active during weekends, I wanted an easy way to disable it on weekends and enable it after weekends (or maybe not enable it, I think I'll enable it manually depending on whether I am actually working or not etc).

So... there was an Azure outage today. Related to Azure Front Door. That was my evening gone! As the resident PowerShell person on the incident call, as part of implementing some workarounds I had to add a bunch of IP addresses to a Network Security Group. I was given a text file with a bunch of IP addresses, and my task was to add them all to the NSG as "Deny" for "Inbound" traffic.

I enjoyed "A House of Dynamite" which was released this week on Netflix. Not many people seem to like it though! Yes, the ending was abrupt, but I loved it. To me that made sense, and it was the only possible ending one could have for a movie like this. The movie wasn't about the ending, it was about the ordeal leading towards the ending.

I use Firefox. And I use the multi-account containers extension heavily in that. Very useful at work too when I have multiple test account and want to sign in with these, as I can open these up in separate tabs as opposed to separate windows as one would do with Edge etc. As part of testing some new Conditional Access policies however, wherein we were limiting users to hybrid joined or compliant devices, I noticed that my test accounts stopped working with the "You can't get there from here" message.

I wanted to get a list of users recently removed from an Entra ID group. I can see the removals in the audit logs, but there's easy way to add a column showing removals. Enter KQL. We are sending all audit logs to a Log Analytics workspace, so I queried this info that way. This is a very trivial use of KQL, but I am just putting it here for my own reference later on... 

A colleague reached out regarding an issue. He had created a Team and applied a sensitivity label to it. Unfortunately, this sensitivity label disabled external sharing. He then went ahead and remvoed the label, but he still couldn't add external users (even after waiting for a few days). I took a look at the group and found that sharing to guests is still disabled.

O365 add-ins, also known as M365 Apps or Integrated Apps, are what you can deploy to Outlook etc. via this section of the M365 admin center. As per the docs, you need to be a Global Admin or an Exchange Admin (possibly with Application Admin, depending on certain conditions) to do this. And while that seems to be the case with the portal, it looks like one can do some tasks with only the Application Admin role via PowerShell.

At work I spent some time yesterday working on a side project to setup forwarding from one set of URLs to another. We are migrating a service from our on-prem world to the cloud, and there are tons of URLs pointing that will now get invalidated as a result. In the on-prem world the URLs are of the form

Quick shoutout to "Code Dependent" by Madhumita Murgia. I stumbled upon it at Waterstones the other day and purchased it on a whim. So glad I did as it was a very enjoyable read. I was half expecting (and not looking forward to) it being a book that bashes AI (or goes the other way and gushes over it). Instead, this book was very neutral.

Little things in life... but I killed an AI idea today at work, and I am pleased about that. 😀 A colleague reached out with a requirement he got from someone else. They wanted to create an AI agent that will scrape the Internet for certain types of news and put it into a SharePoint site. I looked at the problem differently and said this doesn't need AI.

"Sahasam" is a fun movie! I stumbled upon it in Amazon Prime, and was familiar with it coz of its amazing songs. Here's three of them: A variety of numbers, as you can see. One is a remix of an older song, another is an Onam number, and finally a trance one. Anyways, the movie didn't disappoint. Was quite funny and I enjoyed it.

Brendan Carr’s contempt for the First Amendment is going strong.

Just wanted to give a shout out to one the best shows to come out in recent years - “Resident Alien”. It ended last month after four amazing seasons and I just caught the last episode yesterday. “Resident Alien” is one of those rare shows that keeps the momentum going each season, and each season is actually as good as the previous one and builds upon the characters.

I have an Azure Automation Account Runtime Environment with a few Graph module installed. As you can see th existing ones are on version 2.25.0. I want to add the 'Microsoft.Graph.Applications' module. You'd think if I tried to install that from the gallery it will either (a) install the 2.25.0 version of the module so it is compatible with the rest; or (b) refuse to install because it can only install the latest version (2.30.0) and that clearly requires the rest of the modules to be at 2.30.0.

Had an interesting issue at work that we resolved today. It's probably not relevant to most folks, but I enjoyed getting to the bottom of it with a colleague (who came up with the eventual fix) and wanted to make a note of it. We have Conditional Access policies for Android, iOS, and macOS that require Compliance, or Compliance and App Protection.

Had to whip this up for a colleague. Turns out I was already doing this in one of my runbooks but had forgotten. Now that I rediscovered it, time to put it here for future reference. This PowerShell code will go through all your connectors (except the outgoing one), make a list of forests and the included and excluded OUs and put them into a variable called…

A follow-up to a previous post... I don't know if what I what I say below is accurate, take it with a pinch of salt. As mentioned in that post I have a function that checks if a runbook is already running, and if so waits or quits. One of the things this function needs to do is find the job Id of the runbook, so it can use that to lookup the runbook name and other details and then find if there are other instances of it.

After stopping development of its innovative Arc browser, The Browser Company is back with Dia, a stripped-down browser that aims to make AI-augmented Web interactions mainstream. It won’t win over...

My second Seichō Matsumoto book. The first was "Tokyo Express" which was a shorter and more murder mystery than "Inspector Imanishi Investigates", and I enjoyed a lot. The solution to the mystery was very neat too. "Inspector Imanishi Investigates" too is great, but it's a different sort of mystery. I was reminded of the malayalam movie "Rekhachitram" which I saw some months ago and loved very much (didn't blog about it).

Wasn't aware of the movie "Ponman" but stumbled upon it in Hotstar today and saw it. A must-watch thriller starring Basil Joseph, in a very different role, I loved it! Basil's been experimenting a lot nowadays, including Maranamass which I recently watched, and Sookshmadarshini. "Ponman" is a lot about gray characters. It's hard to find fault with most of the characters in the movie - they are all just trying to survive, all due to societal pressure regarding gold and its role in marriages (dowry).