EntraID

Problem Recently, one of our users got this error while inviting a guest to our tenant: Error in your face Please configure B2B collaboration settings correctly and troubleshoot first, “https://aka.ms/b2b-troubleshoot". Error from Entra B2B: At least one invitation failed. Error: ResponseStatusNotOK, message: Group email address is not supported. Looks like a tenant-wide issue, right? Solution There isn’t one - distribution lists cannot be invited as guest accounts. Afterword The admin sees a clean, simple message directly in Entra ID under Invite External User - the user gets a wall of text. ...

What’s that? Just another script for listing users and their group memberships. You feed it a text file with UPNs, it queries Microsoft Graph, and spits out a flat CSV like: UserPrincipalName PrimarySmtpAddress GroupName GroupEmail GroupType [email protected] [email protected] Some DL [email protected] DistributionList [email protected] [email protected] Security Group ABC [email protected] MailSecurityGroup [email protected] [email protected] Some DL [email protected] DistributionList Where’s it? On GitHub Requirements PowerShell 5.1+ or PowerShell 7+ Microsoft Graph PowerShell SDK Permissions: User.Read.All, GroupMember.Read.All, Group.Read.All

Problem If you want to add or remove (basically update) a proxy address on a cloud-only account - without an Exchange mailbox - you cannot. There is no such option in the GUI and PowerShell won’t allow it either, throwing an error: Set-MgUser : Property 'proxyAddresses' is read-only and cannot be set. Status: 400 (BadRequest) ErrorCode: Request_BadRequest Solution Use the Graph API BETA endpoint. Method: PATCH URL: https://graph.microsoft.com/beta/users/<User_ID> Request Body: 1 2 3 4 5 6 7 8 { "proxyAddresses": [ "SMTP:PrimarySMTPAddress", "smtp:Alias1", "smtp:Alias2", "smtp:Alias3" ] } Expected Response: 204 No Content An example ...

Domain Removal Issues If you want to remove a domain from an M365 tenant, you need to deprovision all associated objects first - easy to say, harder to do. If the domain is not federated, M365 can handle it for you - it simply removes aliases and updates the Primary SMTP address and/or UPN to the default domain (domain.onmicrosoft.com). However, this does not work for federated domains. You have to remove everything manually, which is manageable for one domain. In my case, I had to remove 150. ...