The new permission in Graph API – Sites.Selected – is a step in the right direction. Since long we have been looking for ways of scoping the accesses to live up to the least privilege principle. It was either nothing or everything. I have tried out the new Sites.Selected permission and here are my findings.
First of all, if you haven’t heard about Sites.Selected, please visit these pages to find out more. I am skipping the introduction, since there are already good resources on that out there.
Once you have your Azure AD App and the admin consent for Graph Sites.Selected, all you need is the Azure AD Application Id and Site Collection Administrator on a particular site. The simplest way is to use PnP.PowerShell:
The only way to the application permissions is PowerShell or Graph, there is no indication on the site.
Get-PnPAzureADAppSitePermission
What about governance
A site collection administrator can grant Read or Write permissions on a site. It gives the desired granularity for application access. But on the other side, there is no way (as of writing) to get all the sites that an Azure AD Application has permissions to.
Which leads me to the biggest weakness of the today’s implementation. Of course, we can traverse through all the sites using powershell and get the summary of all application permissions. The problem is that it can be time consuming in a bigger where you have plenty of sites. Also, it requires that your account that runs the script is a Site Collection Administrator on every site, which is a complete opposite of the granularity goal that Sites.Selected permission tries to achieve.
With that you might end up with several applications that have Write permissions to many sites and you might not have any clue wether it is used or not, who has access to those applications and if they need it.
My wish is that:
There will be an api (graph) or azure cli (or similar) that can list all the sites that an application with Sites.Selected has access to, without me being a Site Collection Admin on every site.
There will be transparency in the user interface, so that users and site owners can see which applications can read and write content on their sites, the same way as we can see the members of a site.
I would like to show you my recent hobby project with a raspberry pi, a unicorn phat and the powerful cli-microsoft365: A simple monitoring solution of Microsoft 365 Services.
Status of some important services in Microsoft 365
In essence, I put the unicorn phat onto the raspberry pi zero w and wrote this python script:
The python script checks the service status every five minutes and shows it with colors on the unicorn phat.
Color coding
Since the unicorn phat is just a grid of 8×4 rgb leds, I needed to color code the different service statuses (more on the statuses later in this post). I came up with these color combinations. It doesn’t matter what combinations they are as long as they mean something to you (or as long as you can decode them).
🟩 🟩 🟩 🟩 ServiceOperational
🟩 🟩 🟩 🟨 ServiceRestored
🟪 🟪 🟪 🟪 Investigating
🟩 🟩 🟩 🟪 FalsePositive
⬜️ ⬜️ ⬜️ ⬜️ InformationUnavailable
🟥 🟥 🟥 🟥 ServiceInterruption
🟥 🟥 🟥 🟨 ExtendedRecovery
🟥 🟥 🟨 🟩 ServiceDegradation
🟩 🟩 🟩 🟦 PIRPublished
🟥 🟨 🟨 🟩 RestoringService
ServiceStatus
There is a list of all possible statuses you can get for Microsoft 365 Services, and it is here:
Install the cli-microsoft365 npm package globally.
sudo npm i -g @pnp/cli-microsoft365
You have to log in, admin consent (if you run this for the first time) and then you can get the status of the Microsoft 365 Services by running:
m365 tenant status list
Services
There are many services in Microsoft 365. I choose the 8 most important ones (from my point of view), because there are only 8 rows on the unicorn phat, you can choose your services and order them as you prefer of course. Beware the spelling and the casing:
SharePoint
microsoftteams
Exchange
OneDriveForBusiness
yammer
Forms
PowerBIcom
Intune
Assembling the hardware
I had my raspberry pi zero w, with raspberry pi os already installed. I attached the unicorn phat using solderless pogo pins. I found a little white cardboard box, cut out a rectangular hole for the unicorn phat and glued the raspberry pi with unicorn inside the box. On the front side I put a sticker with the actual service names for every led row. I connected it to the power, ran the script.
Only three pins are needed.I tested it first without a box.I glued the hardware on the inside of the cardboard with a glue gun.Exploring the @pnp/cli-microsoft365.
Other tips and tricks
The pogo pins were to loose and the leds did not work. I had to shorten the plastic holders a little to tighten the the pins.
Login to cli-microsoft365 as sudo
When I explored the m365 commands, it worked perfectly. My login was cached. Then I needed to run my scripts as sudo, since it requires communication with GPIO pins and the unicorn phat. It didn’t work. The login cache is in different place if you run as sudo. Obvious, when I look at it afterwards, but it took some time to realize that. So, if you are going to do the same, just make sure you log in to m365 as sudo as well, before running the script:
sudo m365 login
Pinout
This web resource is gold, it shows the pinout and connections to many hats etc:
Den här bloggposten är ett (en aning större) användar- (eller verksamhetsutvecklar-)tips om hur man kan sätta upp smarta utskrifter till SharePoint Online – utan några extraappar eller lösningar.
Först och främst, stort tack till min kollega Shahram som har presenterat idén för mig. Tänk dig ett följande scenario:
Du har en mall i Word som du fyller i, skriver ut på papper. Låt säga, det är en plockorder. Du vill digitalisera processen genom att skicka pdf:en till ett gemensamt dokumentbibliotek i SharePoint eller Teams.
Tekniskt är det enkelt, bara man i sin grupp kan komma överens om att göra det så. Då finns många möjligheter, både för att spara skog och kunna samarbeta smartare.
SharePoint-bibliotek
I det här scenariot använder jag ett bibliotek i SharePoint Online, men du kan koppla det även till Teams eller personliga OneDrive. Låt oss kalla det “Plockordrar”
OneDrive-genväg
Nästa steg är att lägga till en genväg till min personliga OneDrive. Man kan såklart synkronisera direkt, men i det här fallet väljer jag en OneDrive-genväg.
Mappen dyker snyggt upp på min dator:
Utskrift
Jag trycker på “Srkiva ut” och väljer “Microsoft Print to PDF”
Sedan väljer jag min OneDrive och “Plockordrar” och skriver in namn på filen
Det dyker upp i dokumentbiblioteket.
Smarta funktioner
Nu är jag inte längre begränsad till det analoga. Jag kan jag göra all magi som finns i SharePoint Online för att sätta upp ett smart samarbete med mina kollegor, som till exempel:
Lägga till kolumn Ansvarig och en vy “Mina plockordrar”
Lägga till kolumn Status för att skilja på aktiva och färdiga plockordrar
Lägga till kolumn Datum för att hålla en eventuell deadline
Använda kommentarer för att samarbeta med mina kollegor
Sätta upp alerts och påminnelser
Sätta upp godkännande-flöden etc
Formatera listan med olika färger för att kunna se bättre aktuellt arbete
Nästa gång du skriver ut från Word till PDF, kommer systemet ihåg ditt senaste val, så att det kan gå riktigt snabbt.
Det analoga
Den här processen betyder inte att det en tvär övergång till digitalisering heller. Det går fint att kombinera speciellt om man föredrar att ha det på papper! Mer än så. Du kan skriva ut den flera gånger om så behövs. Du minskar risken att det faller mellan stolarna (bokstavligt) och kan minska stressen för dig och dina kollegor.
Andra appar
Det finns dedikerade appar för att skriva ut till SharePoint, de kan vara mer precisa i vissa fall, men även med befintliga medel och smarta processer kan man ha ett smart samarbete i Office 365.
We have had troubles updating site icons in SharePoint Online. It might be related to one of the following:
It occures only on hub sites
The sites have a custom theme
The error message:
We experienced a problem updating the icon. Please try again in a few minutes.
But what I found is that there are two places where you change the site icon. If the first does not work, try the second one, that was what worked for us:
Cog wheel -> Site Information -> Site logo
Cog wheel -> Change the look -> Header -> Site Logo
Changing the logo through “Site Information”Changing the site logo through “Change the look”
There are others who have encountered the problem. I hope the workaround I happened to find here can help.
Sites in SharePoint are created all the time, not only for SharePoint, but also as storage for Yammer, Teams, Planner and other services in Microsoft 365. There are ways to keep track of them, but the ability to automatically detect a new site creation is quite appealing. Automatic detection means a trigger of a Power Automate (Flow) or a Logic App.
There are a few blog posts that exactly describe how you can detect when a new site is created in SharePoint Online:
The provided blog posts are great how-tos, I am not giving you a new how-to for that, I’d like to reason about that solution.
The solution for automatic detection of new sites
Power Automate and Logic Apps can listen to new items in SharePoint. There is a list in the admin site (tenant-admin.sharepoint.com) that has SharePoint Sites as list items, its name is DO_NOT_DELETE_SPLIST_TENANTADMIN_ALL_SITES_AGGREGATED_SITECOLLECTIONS.
That’s it, in essence, it’s just setting up a new flow with “When an item is created in SharePoint” as a trigger, and you have thousands business scenarios you could implement, but let’s dig a little bit deeper.
One List to rule them all
Honestly, I was not aware of that list before I started looking at that. What is that list, why is it called DO_NOT_DELETE_SPLIST_TENANTADMIN_ALL_SITES_AGGREGATED_SITECOLLECTIONS.
The name is hillarious. Why name something to “DO_NOT_DELETE…” and all capslock🤣. But I suppose, there were support cases.
Beware, that list is not documented, that means you’re on your own when Microsoft changes the name or moves the list to somewhere else. So don’t build business critical solutions with that.
From what I can see, that list keeps information about all sites (site collections) in SharePoint Online, even those that are deleted and permanently deleted (?). This might be a source for deeper troubleshooting in some scenarios. It is like an old card index in a library you might have seen long time ago. It is hidden nowadays, but it is still there.
First, that list is in the SharePoint Admin Site Collection, you need to be at least a SharePoint Administrator to access it. Okay, I’d like to know what’s more in its Site Contents (_layouts/15/viewlsts.aspx):
Well, the UI of that page has not been focused on, but nevermind, the lists are there. But you cannot navigate to that list in the browser directly:
It doesn’t matter since we can use it as a trigger but also the SharePoint REST API to get the items, e.g.:
You can see more examples of listing the sites in the linked posts. Unfortunately I bumped into an issue when trying to filter the results. If that list contains more than 5000 items (and it will, soon or later), you’ll have to deal with the ListView Threshold.
If you filter on Modified, you won’t able to anything because of the ListView Threshold, but filtering on Created will work.
But this is a side note, this post is automatically detecting new sites, not listing them
Alternative solutions
Using this kind of a hidden list mentioned above is a bit of a hack. I’d say it’s okay as long as it works, and it serves an complementary function, e.g. notifying IT about new sites, and the work is backed up by documented and reliable alternatives:
SharePoint Online Admin
Visiting “Active Sites” in SharePoint Online Admin gives you all the sites, you can sort by Created and see all the new sites. You cannot set up an alert or a flow directly from that, but maybe there will be some built-in functionality for that.
Office 365 Usage Reports
You can get all the sites in an Usage Report, their created, size, last activity etc. It’s not real time, but if you’re fine with 1-2 days delay, you can get this report, extract the new ones and do whatever you wanted to do in your original scenario/need.
SharePoint PowerShell Module
It’s worth mentioning, too, although it’s “heavy”. In a tenant with many sites, the scripts for getting all the sites and connected groups may take hours. I am refering to those scripts that start with Connect-SPOService.
Permissions, Licenses, and Security
The SharePoint connection that listens to the DO_NOT_DELETE_SPLIST_TENANTADMIN_ALL_SITES_AGGREGATED_SITECOLLECTIONS list in the Admin Site Collection needs to be set up with a SharePoint Administrator role account. Beware of who has access to that solution (Power Automate or Logic App), this SPO Admin connection in wrong hands can be disastrous. Especially in Azure, pay attention to who has access to the resource, but also to the resource group and the azure subscription.
The account who sets up a Power Automate needs obviously an appropriate license and also Power Automate activated. In my scenario, I don’t need any premium connectors, but depending on your solution, you might need to license your account appopriately.
Scenarios
In “my” scenario, I want to be notified of all new sites in my business unit within a shared tenant, so that we can contact the site owners, provide guidance and also provision important parts (initial folder structure, some spfx solutions etc).
What is your sceanario?
The code
When I am done developing my proof-of-concept, I’ll try to share more details on the actual implementation. It might be an idea to submit the template to the Microsoft Power Community, but I am not sure it will be accepted, given the fact that it uses undocumented and hidden parts of SharePoint Online that soon or later will be subject to change.
Nowadays a Yammer Community gets a corresponding Microsoft 365 Group (Office 365 Group, Unified Group). In your work as an SPO Admin, you might need to differentiate “ordinary” Modern Team Sites from those ones that were created for a Yammer Community.
They both have GROUP#0 as Template. On the actual SPO Site object, there is nothing that you can use to differentiate those. Neither you can use the Office 365 Group information. But there is a way: if you connect to Exchange Online and get the group from there, then there is something useful.
I’ll share a piece of code with you, as the rest of the posts and code snippets, it is “evergreen”, it changes all the time, maybe when you read this in future, there is a better way, but today I am using this code:
# Prerequisites
# AllowBasic as Admin, perhaps in a separate window
For uploading and deploying SPFx packages I found these permissions to be the bare minimum:
Delegated Microsoft Graph User.Read
Delegated SharePoint AllSites.FullControl
Service Account
The second part is the service account that just has access to one site collection – Tenant App Catalog. That plus Delegated AllSites.FullControl of the app registration narrows the access to just that site. To install apps the Uploader Account needs to be Site Collection Administrator.
Least privileges for SPFx Upload & Deploy
Azure Pipelines
In our project we use Azure Pipelines where we also define the release using .yml. The deployment consists of series of bash inline scripts.
I am not going to describe all the steps for setting up node, npm and installing the office 365 cli. If you already have used Office 365 CLI with the default AAD APP it might look like this:
– task: Bash@3 # login
displayName: "Login to O365 spAppCatalogSiteUrl with user $(username)"
That’s straight forward when you run the cli in your own console. But the fact is (or at least from what I can see), you cannot “export” variables to other pipeline tasks.
Instead of setting the variables in the inline script, we can take advantage of the Bash task parameter called env:.
Some other findings:
Office 365 CLI needs them in all three commands: login, spo app add, and spo app deploy
If you create and export a variable in a pipeline task, it won’t persist, because every task starts a new shell session.
That means that we need to provide environment variables in every task in the pipeline, that uses Office 365 CLI with a custom Azure AD App. Or is there a better way? Anyway, the version below (the same tasks plus `env`) will work:
– task: Bash@3 # login
displayName: "Login to O365 spAppCatalogSiteUrl with user $(username)"
My goal is to remove the need of legacy authentication. Previously we installed spfx packages using PnP PowerShell. PnP PowerShell in Pipelines causes Legacy Authentication, it can be solved, though:
Jag förstår att det är väldigt mycket kod för att få till kalendervyn och att det inte är så lätt omvandla till ett modernt utseende, men det ställer till eftersom det upplevs som gammalt och inte användarvänligt ute i verksamheten.
Varför behövs en SharePoint-kalender
Jag ska lista några alternativ och förklara varför en gammal dinosaurie är fortfarande det enda vettiga alternativet (i väntan på en “modernisering” av lsitan)
En Office-365-gruppkalender
Det är en bra funktionalitet för en enkel kalender. Den saknar:
Stöd för extra kolumner och innehållstyper
Den är svår att dela med externa användare
Händelser (Events)
Om du inte hittar länken till den här sidan, finns den under <site>/_layouts/15/Events.aspx. En snygg modern sida som kan visa kalenderhändelser från flera kalendrar på SharePoint-siten. Dess begränsningar är:
Går inte att anpassa, eftersom det är en systemsida (layous-sida)
Den visar bara det minimala om händelser
En kalender utanför Office 365
Har man egen kalenderdata, är man friare, men man förlorar fördelarna med att ha/betala för en dyr platform. Om man också har ett eget gränssnitt för det kostar det att i längden med alla anpassningar och buggrättningar.
SPFx-lösning
I SharePoint skulle man kunna ha en SPFx-lösning för att presentera kalenderdata på ett snyggt sätt. Men det får avvägas mot kostnader. Det fina med inbyggda kalendern var att den bara fanns där, den ingick i plattformen.
Kalendern i SharePoint
Till fördelarna av kalendern i SharePoint hör:
Det är en del av ett större ekosystem. Power Automate eller PowerApps kan kopplas på, som ett exempel. Det visas också i moderna Events.aspx
Det är anpassningsbart på ett enhetligt sätt, som alla andra listor. Användare med rätt behörighet kan skapa nya kolumner, definiera innehållstyper med mera.
PnP-mallramverket kan både exportera och importera en kalender.
Listvyer, behörigheter, mappar, allt det ingår om man behöver det, på samma sätt som det gör för alla andra listor i SharePoint.
Möjlighet till sök och aggregering ifrån flera siter.
En chans att det moderniseras utan att man behöver investera något i det extra.
En förenklad vy genom “Händelser” av samma kalenderlista.
Lite tips och tricks för gamla kalendern
Här kommer en liten samling av enkla men intressanta tips för gamla kalendern.
#1 Välj tid för en ny händelse med en annan innehållstyp på ett smidigt sätt
Det här har varit en av de sakerna som man varit mest frustrerad över. När en kalender har flera innehållstyper, går det inte att byta innehållstyp i NewForm när du klickar i kalendervyn.
Om du väljer en annan innehållstyp, måste du manuellt ange tiden. Det tar tid. Föreslagna tiden är bara aktuella timmen här och nu.
Tipset är att:
Hitta rätt dag och markera rätt tid i kalendervyn. Rutan får en blåaktig färg.
Klicka på “Ny händelse” i Ribbon (vad var svenska namnet för det?).
Vips så har du tid och datum rätt ifrån början
#2 Kalenderöverlag
En klassiker, en av mina favoriter är möjligheten att visa kalenderhändelser med olika färger – kalenderöverlag. Tyvärr är det begränsat med färger.
#3 Visa veckovyn utan att ändra inställningar
I länken till din kalender (t.ex. i vänstermenyn), lägg till “?calendarperiod=week” i URL:en, så visas veckovyn automatiskt.
Recent Comments