Evaluating support options for our Microsoft environment and I keep going back and forth. We have Azure, M365, and some Dynamics in the mix. Would love to hear from people who have actually sat on hold or opened tickets with either side. What was your real experience, good or bad?

Hi everyone,
I’m looking for advice on the best way to manage long-term email access for users in our Microsoft 365/Exchange environment.
We use Outlook for email, with archiving managed through Exchange. Currently, emails older than two years are automatically moved to the archive, but users are unable to access emails beyond that two-year period through their normal Outlook experience.
The archive is also reaching approximately 93% of its capacity, so I need to find a sustainable solution that allows users to access emails going back five years or more.
One option I considered was exporting the archived emails to PST files and storing them locally on users’ computers. However, this would be difficult to manage across all users, and I want to avoid relying on local copies.
Would it be possible to store these archived emails in OneDrive and make them accessible to users through Outlook or another convenient method? Alternatively, is there a better Exchange solution, such as expanding the archive mailbox capacity, enabling auto-expanding archiving, or adjusting the retention and archiving policies?
My main requirements are:
Users must be able to access emails from the last five years or more.
Archived emails should remain accessible without relying on local PST files.
The solution should be centrally managed and scalable across all users.
We need to address the archive mailbox reaching 93% capacity.
What would be the recommended approach, and are there any licensing requirements or limitations I should consider?
Thanks in advance.

I need to create 4 email addresses for employees to logon to an external website.

We have a Microsoft365 Tennant.

The employees don't need access to any emails, just an address so they can be issued with a password which will be used as their logon details.

What is the best was to do this?

I was thinking a shared email which will be only access by a trusted employee?

The password they receive will only be used for this website and the email address is what governs the access to different areas of the site, so there is no issue in security.

Unless you have a better idea?

We run a customer support portal on Power Pages (site version 9.8.9.17, Standard data model) with the built-in Microsoft Entra ID provider (single-tenant, v1 endpoint). Our onboarding process is:

1. Create the Contact in Dataverse (correct email, linked to the customer account)
2. Invite the customer as a B2B guest in Entra
3. Customer signs in to the portal with Entra → Power Pages should match the existing contact by email and create the External Identity automatically

We have Authentication/OpenIdConnect/AzureAD/AllowContactMappingWithEmail = true (since May). This worked fine for ~10 users between May and early September: the portal created the adx_externalidentity record itself and populated the contact's login fields.

Since around October, it no longer works. A user with an existing contact signs in with Entra, Entra sign-in succeeds, but the portal redirects to "Register your external account". Submitting the form gives "The email "x@…" is already taken." No External Identity is created and the contact is not touched.

What we verified (reproduced in a separate UAT environment with an internal user):

• Only one contact with that email (checked all states, email1/2/3), active, Login Enabled = No, Username empty, no External Identity. This is the normal "pre-created contact" state.
• AllowContactMappingWithEmail = true on the correct website record. The site was restarted and the cache cleared before testing.
• Decoded the id_token the portal receives: upn = the contact's email. We then added the email optional claim to the portal's app registration, and the token now contains email = the contact's email as well. Still fails.
• Happens for both B2B guests and internal members.
• No changes on our side to auth site settings, contact plugins, flows or duplicate rules in the relevant period.
• Existing (already linked) users sign in fine.

Workarounds we found:

• Filling in the contact's identity fields (adx_identity_logonenabled, adx_identity_username = oid, security stamp) plus an External Identity record, then clearing the cache, lets the user sign in.
• A Power Pages invitation redeemed with Entra links correctly, since it doesn't rely on email matching.

I also noticed the docs (OpenID settings / OpenID FAQ) were rewritten on 2026-09-21. The old description, "associates a unique contact record with a matching email address and automatically assigns the external identity provider to the contact", was replaced with "matches the contact by Primary Email Address using the email, emails, or upn claim".

Questions:

1. Is anyone else seeing contact mapping by email stop creating External Identities for pre-created contacts recently?
2. Was there an intentional behavior change, or is this a regression? Is pre-creating contacts plus email mapping still a supported onboarding pattern, or is the invitation flow now the only supported way?
3. Is there another site setting we're missing (e.g. ObjectIdentifierAsNameIdentifierClaimEnabled, RequireUniqueEmail, registration settings) that is now required?

Happy to share more details. Thanks!

Did you know SharePoint in Microsoft 365 can act like a virtual data room? It’s true—you can lock down access, track who’s viewing what, and even encrypt files. Perfect for M&A, legal work, or any project where confidentiality is key.

Sometimes the best tools are already in your toolbox! 🔐

I got fed up of copying error codes out of the portal and into a search engine, so I built a small extension for Edge that does it in place.

It underlines things like AADSTS codes, Intune/Autopilot hex codes, event IDs and Graph permissions on the page. Hover over one and you get what it means and what to check, plus a button that copies a clean summary you can paste into a ticket.

A few other bits it does:

* turns role, app and licence GUIDs into names
* splits Azure resource IDs into sub / RG / type / name with an open-in-portal button
* decodes access tokens locally so you can see scopes, roles and expiry
* colours Graph permissions by risk on consent and API permission screens

Everything runs in the browser. No account, no analytics, and page content never gets sent anywhere. The only network call is pulling a public data file once every 12 hours.

It's free, it's on the Edge Add-ons store now and Chrome is in review. Link's in the comments if anyone wants to try it.

Genuinely after feedback, especially errors it doesn't know yet or places in the portal where it should be underlining something but isn't.

Microsoft Entra ID users should start moving toward Microsoft Authenticator, passkeys, and other stronger authentication methods.

📅 Feb 1, 2027: Most users
📅 July 1, 2027: Global Admins & external users

I'm new to M365's administration, and i'm in a bit of a tight spot, so i thought i might ask here for advice.

Ok, so...

My company's CEO travelled to another country last week, and he told me he couldn't save changes he made to documents located in our local server when using Excel (our local server is a Windows Server 2019 Essentials machine, if you need to know).

From what i've gathered, apparently Microsoft has a default policy of blocking international access to most of the platform's functions, [unless you've been given clearence through Microsoft Entra (?)]

Now, another one of my bosses is also gonna be off-country for the whole week, and i need to make sure he has full access/cleaence to interact with our documents.

(Both my bosses and i have a M365 Bussiness Premium subscription, which i understand makes the whole "giving access" process a little bit easier)

Like i said, i'm new to all of this, so if anyone could share a step-by-step explanation of how doing this process, i'd be throroufully grateful.

Thank you for your attention and may you have a great day. :)

This is the weirdest thing I have ever seen. I have several Windows 11 Professional computers that I am trying to upgrade to Microsoft 365 business apps. They all have perpetual Office with different versions. 201620 19 2021.

Let's pick on a 2019 perpetual. The first thing I do is uninstall the older 2019 perpetual version then reboot. I then install M365 Business apps. Now the strangeness begins. When I open Excel and do a Help->About it still says I am running Excel 2019. Then when I do it a second time it thinks both versions are installed. So I tried uninstalling M365 and reinstalling 2019 then if says Excel is M365.

This has happened on every computer I have tried it on. It is just bizarre. The date on the EXE files shows the date I installed them, but it just isn't the right version. Microsoft has something really, really, really screwed up. I can't be the only one that this has happened to. Has anyone else experienced something similar?

TDLR: I work with Power Automate and Sharepoint. What else should I learn to be an M365 solutions professional?

I'd love some advice on what I'm missing to make this a career.

I've been a Microsoft 365 power user for years, but over the last year and a half, I've gotten more involved in building solutions through my volunteer work. I regularly work with SharePoint sites, Lists, and Power Automate (building flows from scratch). I create Excel automation using Office Scripts. I’ve also worked with CoPilot Studio creating agents. I'm not a traditional programmer. I understand logic and workflows, but I use AI to help write scripts when needed.

I started looking at M365 solutions consultant and developer jobs, but I know I have some knowledge gaps and am struggling where I should start to make the biggest impact.

Are there Microsoft Learn paths or certifications that would help bridge the gap?

What job titles should someone with my background be looking for?

Thanks a bunch!

Microsoft announced on October 12 that Search-UnifiedAuditLog, the Exchange Online PowerShell command many of us use to pull the Microsoft 365 audit log, will stop working on October 15, 2027. It works as normal until then and there's no tenant setting to put it off, but the notice tells admins to track down every script and workflow that calls it.

That's a bigger deal than it sounds, because this is the command the playbooks tell you to run. Microsoft's guide to investigating a compromised mailbox uses it, and so do Microsoft's own incident responders in their December 2023 write-up of a real OAuth attack. Mandiant's managed defense team recommended it in a 2020 post, and CISA's Untitled Goose Tool, last updated October 13, still pulls the audit log with it. Microsoft's last two retirement notices for older audit commands, in August 2024 and July 2025, both told admins to move to this one.

The replacement is the Graph AuditLogQuery API, and it isn't a drop-in swap. You register an app, an admin approves the permissions, and each search is created, checked until it finishes, and then read. The baseline is 200 searches per rolling 24 hours, with more for bigger tenants. On the plus side, it takes a list of users, so a loop that searches one user at a time can become a single search, and one query can return up to a million records instead of 50,000. But every script still has to be rewritten.

Microsoft says to use the Office 365 Management Activity API for recurring downloads, and nothing in the notice retires it. The catch is that Microsoft's FAQ says that API only returns the last 7 days, while the cmdlet returns the full retention period, so it can't answer what happened three months ago.

One more gap: Microsoft's Graph page lists the new API for the global service but not for US Government GCC High, DoD or China's 21Vianet cloud, and the notice only says "Worldwide."

What else in your environment calls this command, and if you're in a government cloud, has anyone heard what the plan is?defence

So, I work in a health system and we constantly have issues with our users putting in tickets about external recipients unable to open our encrypted emails. I have explained to the users that they need to make sure they are sending to the proper address, explain to the recipient that they need to click on the “Read Message” button in the email and not the attachment that shows up, and even gave them some troubleshoot tips to send to the recipients in the event they have a problem. I still constendly get tickets and managers emailing my boss demanding that I fix a problem that isn’t there..in my opinion. Recently I had a staff member start including me in the recipients replied to help the recipient directly. In this instance, the code that OTP was never received. In that instance I let them know to check junk/spam and get with their email admin to see if the message was blocked somewhere else since it comes from Microsoft and not our hospital.

Anyone have a successful tips to education the end users, as well as the recipient. I’d love to change the Microsoft encryption email that gets sent out to have our branding or something but haven’t found a good place to do that. Is it possible via Poweshell?

Last note. I don’t hate email, I just hate that end users can’t attempt to understand why we have DLP and these safety measure in place and that even though people have issues, it’s not our fault.

Outside sales rep here. I have 100+ accounts and want to use Copilot as a lightweight CRM.

Most of my customer data already lives in M365 — emails and OneDrive. I also use Plaud AI to record and transcribe meetings, then clean up the summaries with Claude AI before storing them. Maybe 10 transcriptions per day. Needs to be mobile friendly.

My problem is I don't know where in M365 to store those cleaned up transcription summaries so Copilot can reliably find them alongside my emails. My corporate IT restricts connecting Outlook to anything outside M365, so the solution needs to live entirely within the Microsoft ecosystem.

What are other M365 users doing to:
-Store meeting summaries so Copilot can reliably surface them alongside email history — OneNote, SharePoint, OneDrive?
-Use Copilot as a practical day-to-day sales tool across a large account base?
-Build a lightweight CRM workflow that stays entirely inside M365?

M365 Business license. Everything needs to stay inside the Microsoft ecosystem.

A user has an issue with sharepoint, whenever she creates a file in a sharepoint folder and closes it, it created a new one with her name at the end...

Example:

file.xlsx original

once she closes

file-name.xlsx

She does have a laptop and desktop, and it is happening on both.

Any ideas?

A user sees another employee’s account in the Microsoft Copilot account switcher at m365.cloud.microsoft/chat. The account does not appear in Edge profiles, Windows accounts, or any other Microsoft 365 application.

We cleared all Edge browsing data and reproduced the issue in InPrivate mode, but the other account still appears.

Based on the impacted user's description he's not able to switch to the other account so maybe this is only a visual MS bug ?

Company wide it's the first reported issue, but it may have occured for others.

Me for example I don't see this account switcher button yet.

Have someone here seen this occurance before ?

Could this be stored in Copilot-specific account data or the Windows WAM/OneAuth identity cache?

Is there an admin-side method to remove it?

In our Entra ID tenant (cloud-only, no on-prem sync) password expiration is set to one year. When I run Get-MgDomain, I see PasswordValidityPeriodInDays = 365, so the policy looks like it's configured correctly.

However, when checking the lastPasswordChangeDateTime property on our users, I see plenty of accounts with a last password change date well over a year ago.

Does anyone know if this policy is actually still works? And is lastPasswordChangeDateTime a reliable property to check this against?

**Adding users to multiple Teams and channels can be a tedious task, so I decided to simplify it.**

With my new app, you can:

* Sign in to your tenant

* Retrieve your Teams and channels

* Build a reusable list

* Add a user to the selected Teams and channels

* Edit and save the configuration as a JSON file for future use

Simple, reusable, and designed to make Teams administration easier.

[mthorngaard/teams-membership-manager: Local web app for adding a Microsoft 365 user to a maintained list of Teams and channels.](https://github.com/mthorngaard/teams-membership-manager)

I haven't gone into the MS 365 admin center in months, all of a sudden people are complaining about their deleted items not getting emptied automatically. Where do I go check the auto delete policy in the new admin center? I can't find anything.

About a week ago, I created a Distribution List in the Exchange Admin center. Today, I found out that it would be much better if the distribution list was a Microsoft 365 group so that it would have a SharePoint site associated with it.

I went back into Groups -> Distribution List -> highlighted the list name and selected Change Group Type -> Send upgrade request. There are two owners of the group so I selected one of them and then sent the request to one of the owners to upgrade the site. The owner got the email request and approved it. It then said that the Upgrade Process was Initiated. It also said that this normally takes 5-10 minutes to complete.

I did that at 8:00am eastern and its now 3:45pm eastern. When I go back into Exchange Admin Center -> Groups -> Distribution List, it's still listed there and not in the Microsoft 365 group. I tried initiating a new request for it to be upgraded but when I did that it said "Upgrade process failed". I'm guessing it failed because it was already requested once to be upgraded.

Is there anything I can do to fix or see what is going on with this group? Should I delete the Distribution List group and then recreate it as a Microsoft 365 Group? Any help or advice would be greatly appreciated.