Branding your tenant and managed endpoints

A clear brand builds identity and affiliation. Microsoft 365 and Endpoint Manager has a rich set of tools for customizing your brand into the products. This will look nice and integrated, and it will help the end users detect security attacks. Let's take a deep dive into the possibilities associated with branding your tenant and endpoints!

A brand is a name, term, design, symbol or any other feature that distinguishes one company's good or service from those of other companies. Brands are used for recognition, creating values and identification. A brand is the sum of all expressions by which an entity (person, organization, company, business unit, city, nation, etc.) intends to be recognized.

With a workforce spread all over the modern hybrid workplace, it is more important than ever to spread the love of the company's brand. This blogpost will focus on how your brand can be incorporated to Microsoft 365 and all endpoints by Microsoft Endpoint Manager.

Automating Teams voice reporting of users (2:2)

This is a follow up on my last blog post covering automated teams voice assignment for users. This time I will cover how the mentioned routine has been expanded to do reporting in PowerBI to show evolution and distribution throughout the lifetime of the service.

After running my routine of automated voice assignment in Teams for a while, I felt the need to have an overview of the solution and how it evolved.

Automating Teams voice assignment for users (1:2)

In order to manage voice and phone number assignments in Microsoft Teams, you need at least Teams Communications Administrator role. This role does however have more privileges than most organizations want to assign to their first line staff. This blog post will cover a way for first line to automate voice activation of users with the granularity necessary to cover several technologies such as Direct Routing and Operator Connect.

The main idea is to let first line operators use the tools they have access to when managing users without the demand of acquiring extra privileges.

By adding the Teams phone number in E.164 format to the users telephoneNumber field in AD/AAD and assigning the user as member of a defined security group, I have enough information to automate the Teams voice assignment for the user. This could also include license assignment through the group membership.

Rename computers with countrycode in Intune

During an engagement at a customer there was a demand of having all computers in Endpoint Manager/Intune renamed to a naming standard including the two character ISO country code from the device owner followed by the serial number of the device. This was solved by using Graph API in a Powershell script running in an Azure Runbook.

The mission

The mission is to have all Windows devices in Microsoft Endpoint Manager follow a specified naming standard giving the device a unique name consisting of a country code and the device serial - ie: NO-132435465768. The solution must address existing and new devices.

The challenge with this design is related to compiling a device name consisting of the country code found at the user owning the device and the serial found on the device it self. I have found examples online for renaming endpoints, but these did not get hold of the country codes from the user to use as part of the new device name. Some of these examples include:

• Using OMAURI as explained by Carson Cloud
• Using part of UPN in proactive remediations as explained by Matt Setchell
• Using part of UPN in a script as explained by Maurice Daly

New devices - autopilot profiles

During the initial phase of this project, I did design a configuration for Autopilot allowing the devices to start out with the correct device name upon the initial onboarding. This was based on several group tags matched with corresponding AutoPilot profiles. A specialized menu was built in order to ease the hash collection and at the same time have the group tag specified.

Menu used for selecting country code when getting the hardware hash code

This did work as expected for new computers. The CSV hash file got a Grouptag specified pr. device based on the operators choice when collecting the hash. When uploaded to Intune, the Grouptag did match with an Azure dynamic device group which in turn was targeted towards the corresponding autopilot profile setting the correct name on the device.

Although this was a full-blown technical solution, it didn't live up to the expectations of easy implementation from the first line helpdesk. The setup was therefore reversed leaving one common autopilot profile for each and every windows device in the tenant.

Existing devices - renaming with script

Initially this was thought as a one shot run to rename existing devices. As the first phase of naming new machines during Autopilot was neglected, the challenge is somewhat extended to do renaming of devices on a regular basis. This has led to a Powershell script running in an Azure Runbook on a schedule once pr. day.

Pseudo code

The script has a hash table with current countries. The script will recure the country list selecting all users belonging to each country and further on list each device belonging to those users. Attributes from the user gives access to information about the country, while attributes from the device gives information about the serial number. The script takes into account the maximum length of 15 characters for computer names. This gives the fundaments for renaming the computer to the given naming standard. A rename will be initiated if the existing computer name differs from the standard.

Azure App Registration

The script authenticates through an Azure App Registration which has the following Microsoft Graph API application permissions:

• DeviceManagementManagedDevices.PrivilegedOperations.All
• DeviceManagementManagedDevices.ReadWrite.All
• Directory.Read.All
• User.Read

The app secret for the app registration is created with powershell in order to have extra life time:

    $startDate = Get-Date

    $endDate = $startDate.AddYears(9)

    $ObjectID = 'XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX'

    $aadAppsecret01 = New-AzureADApplicationPasswordCredential -ObjectId $ObjectID -StartDate $startDate -EndDate $endDate

    ($aadAppSecret01).Value

Azure Runbook

The TenantID, ClientID and ClientSecret from the app registration are stored as encrypted variables in the Azure Runbook.

Encrypted variables stored in the runbook

The runbook does have most of the modules loaded already, except for the Microsoft.Graph.Authentication module which has to be added from the Gallery.

The script can now be added, published and linked to a schedule in the runbook. The script is available on my Github, and it has some comments throughout the code describing the process.

<#

  .NOTES

  ===========================================================================

   Created on:      09.05.2022

   Created by:      Simon Skotheimsvik

   Filename:        MEM-ChangeOfComputerNames-Runbook.ps1

  ===========================================================================

 

  .DESCRIPTION

    This script uses the Graph API to bulk rename Windows devices. It can for

    example be used in a scenario where autopilot default naming has been used

    and a new standardised naming convention has been agreed upon. This Script

    will use the Country Code from the owning users Azure Account. It can be

    modified to use other user variables as well.

    The script is designed to run unattended in an Azure Runbook.

     

  .EXAMPLE

    MEM-ChangeOfComputerNames-Runbook.ps1

#>

$GLOBAL:DebugPreference="Continue"

$Countries = @{

    Norway = "NO"

    Vietnam = "VN"

    Brazil = "BR"

    Chile = "CL"

    Croatia = "HR"

    India = "IN"

    Italy = "IT"

    Poland = "PL"

    Romania = "RO"

    Singapore = "SG"

    Canada = "CA"

}

# CONNECT TO GRAPH WITH AZURE APP-REGISTRATION STORED AS ENCRYPTED VARIABLES

$TenantId = Get-AutomationVariable -Name 'Computer_Rename_TenantID'

$ClientId = Get-AutomationVariable -Name 'Computer_Rename_ClientID'

$ClientSecret = Get-AutomationVariable -Name 'Computer_Rename_ClientSecret'

# Create a hashtable for the body, the data needed for the token request

# The variables used are explained above

$Body = @{

    'tenant' = $TenantId

    'client_id' = $ClientId

    'scope' = 'https://graph.microsoft.com/.default'

    'client_secret' = $ClientSecret

    'grant_type' = 'client_credentials'

}

# Assemble a hashtable for splatting parameters, for readability

# The tenant id is used in the uri of the request as well as the body

$Params = @{

    'Uri' = "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token"

    'Method' = 'Post'

    'Body' = $Body

    'ContentType' = 'application/x-www-form-urlencoded'

}

$AuthResponse = Invoke-RestMethod @Params

$Headers = @{

    'Authorization' = "Bearer $($AuthResponse.access_token)"

}

# Connect-MgGraph with Token in order to be able to post a computer renaming

$connection = Invoke-RestMethod `

    -Uri https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token `

    -Method POST `

    -Body $body

 

$token = $connection.access_token

Connect-MgGraph -AccessToken $token

write-output "Authentication finished"

############################################################

# ROUTINE FOR RENAMING USERS AUTOPILOT DEVICES

############################################################

foreach ($CountryCode in $Countries.keys) {

    write-output "Working on country $CountryCode"

    $Country = $CountryCode

    $CountryCode = $($Countries[$Country])

    $MaxSerialLength = (15 - $CountryCode.get_Length())-1 #Max 15 characters allowed in devicename. Calculate length of serial# part.

    $userList = $Null

    # Get all users with the current country code. Use paging in order to get more than 999 which is max pr query

    $UsersURL = 'https://graph.microsoft.com/v1.0/users?$filter=startswith(country,'''+ $Country +''')&$top=999'

    While ($UsersURL -ne $Null) {

        $data = (Invoke-WebRequest -Headers $Headers -Uri $UsersURL -UseBasicParsing) | ConvertFrom-Json

        $userList += $data.Value

        $UsersURL = $data.'@Odata.NextLink'    

    }

    # Get all managed devices for each user

    foreach ($User in $UserList) {

        $upn = $User.userPrincipalName

        write-output "- Focus on user $upn"

        $DeviceList = $Null

        $deviceURL = 'https://graph.microsoft.com/v1.0/users/'+ $User.userPrincipalName +'/managedDevices?$filter=startswith(operatingSystem,''Windows'')'

        $DeviceList = (Invoke-RestMethod -Uri $deviceURL -Headers $Headers).value

        $NoOfDevices = $DeviceList.Count

        write-output "- $NoOfDevices device(s) found"

        foreach ($Device in $DeviceList) {

            $CurrentDeviceName = $Device.deviceName

            write-output "--- Focus on device $CurrentDeviceName"

            $OS = $Device.operatingSystem

            $DeviceID = $Device.id

            $FullSerial = $Device.serialNumber

            # Max 15 characters allowed in devicename - Some devices have to long serialnumber

            if ($FullSerial.get_Length() -gt $MaxSerialLength) {

                $DeviceSerial = $FullSerial.substring($FullSerial.get_Length()-$MaxSerialLength)

                write-output "---- Serial too long - shortened!"

            }

            else {

                $DeviceSerial = $FullSerial

            }

            # Calculates new devicename in format NO-12345678

            $CalculatedDeviceName = $CountryCode.ToUpper() + '-' + $DeviceSerial

           

            # Virtual computers have the text "SerialNumber" as serialnumber...

            if (($CurrentDeviceName -ne $CalculatedDeviceName) -and ($DeviceSerial -ne "SerialNumber")) {

                write-warning "---- Device $CurrentDeviceName needs to be renamed to $CalculatedDeviceName"

                # Calculate graph api url's

                $Resource = "deviceManagement/managedDevices/$DeviceID/setDeviceName"

                $GraphApiVersion = "beta"

                $URI = "https://graph.microsoft.com/$GraphApiVersion/$($Resource)"

                $JSONPayload = @{

                "deviceName" = $CalculatedDeviceName

                }

                $convertedJSONPayLoad = $JSONPayload | ConvertTo-Json

               

                #Send change to Graph.

                Invoke-MgGraphRequest -Uri $URI -Method POST -Body $convertedJSONPayLoad -Verbose -ErrorAction Continue

            }

            else {

                write-output "---- $CurrentDeviceName will not be renamed"

            }

        }

    }

}

Verify the results

When running the script, all outputs can be found in the logs, and all renamed computers are logged as warnings:

Feedback from the script with renamed computers found as warnings

This is reflected on the device in the Microsoft Endpoint Manager:

Device waiting to be renamed

As with other renaming requests in Microsoft Endpoint Manager, it requires the device to reboot before all registers (AzureAD, Intune, AutoPilot, Device) are up to date.

Device rename confirmed in the portal

Summary

This routine will effectively and automatically rename devices on a given schedule as long as the app secret is valid. The script can be altered to mix and match variables from user and device in order to create the corresponding device name for your naming convention. You can for example use information from the user like department, company, region, postalcode as a part of the computername.

No extra charge for the mistakes - solution shared as it is - use it at your own risk.

Thanks for reading - please share and comment.

Veeam Backup for M365 Automatic Reporting in PowerBI

Those of you which has read through the Microsoft services agreement might have noticed paragraph 6b where Microsoft recommends that you regularly backup your content and data that you store on the services using third-party apps and services. One example of such third party tool popular by managed service providers is the Veeam Backup for Microsoft 365. This blog post will explain how you can get automatic reporting on licenses and sizes used by this application.

Please note: This is not a sponsored post!

Data Deletion

Data deletion can occur when an attacker deletes your data, usually in a way that makes recovery difficult, if not impossible. A variant of this type of attack includes ransomware. With ransomware, an attacker compromises the network, encrypts data, and then demands a payment to get the key to decrypt the data. This may equate to data deletion since a successful extraction of payment often leads to more targeting by the attacker. Attacker motivations for data deletion covering the tracks of an attack, attempting to do irreparable harm to your business, or simply trying to spite you or your employees

Preventing data deletion

Other than the protection mechanisms you should employ to prevent account breach an elevation of privileges, your core prevention strategy should be to ensure you have sufficient redundancies built into your data management processes to minimize the impact of data deletion. Data in Microsoft 365 is made redundant for maximum availability by the service. However, it's still possible for an attacker to delete data from SharePoint sites and recycle bins, making it almost impossible to recover. There is also examples of bugs where data has been deleted from Teams and Sharepoint. Therefore, it's critical that you have a process for backing up mission critical data to offline stores - just like the Microsoft Services Agreement states.

Veeam Backup for Microsoft Office 365

Veeam Backup for Microsoft 365 is one application which can help eliminate the risk of losing access and control over your Office 365 data, including Exchange Online, SharePoint Online, OneDrive for Business and Microsoft Teams. This product is often used by managed service providers offering their services to customers. One challenge will be to automate a reporting solution showing the usage of the service related to license and storage on repositories.

Report automation

Niels Engelen has described a way to automatically send reports from Veeam by email. This is a simple approach to the standard functionality where PDF report will be sent by e-mail. It just didn't fit my expectations for reporting. 

PowerShell data harvesting

I have studied the Veeam Backup for Microsoft 365 PowerShell Reference and made a script counting all licenses, data usage and repository usage on a daily basis. This data is prepared in a JSON format and uploaded to an Azure Cosmos Database. The Azure Cosmos Database is quite inexpensive for this kind of usage. 

The following query will list all licensed users in a JSON format before uploading each record to the Cosmos database.

# Get VBO Licensed users, convert to JSON and upload to CosmosDB

$CosmosDBCollectionID = 'VeeamBackupLicenses'

$LicensedUser = Get-VBOLicensedUser

$output = foreach ($user in $LicensedUser) {

    $LastBackupDate = (($user.LastBackupDate).toString()).Split(" ")[0]

    $id = $([Guid]::NewGuid().ToString())

    $doc = [pscustomobject]@{

        id               = $id

        Username         = $user.UserName

        LastBackupDate   = $LastBackupDate

        Year             = (($LastBackupDate).toString()).Split(".")[2]

        Month            = (($LastBackupDate).toString()).Split(".")[1]

        LicenseState     = $user.LicenseState

        OrganizationName = $user.OrganizationName

    }

    $document = $doc | ConvertTo-json | Out-String

    # Writing data to CosmosDB

    New-CosmosDbDocument -Context $cosmosDbContext -CollectionId $CosmosDBCollectionID -DocumentBody $document -PartitionKey $id -Encoding UTF-8

}

The next query will get the usage pr. organization and upload this to a CosmosDB in JSON format:

# Get VBO Usage pr Organization, convert to JSON and upload to CosmosDB

$CosmosDBCollectionID = 'VeeamBackupUsage'

$Organizations = Get-VBOOrganization

$Date = get-date -Format "dd.MM.yyyy"

$UsageOutput = foreach ($Org in $Organizations) {

    $UsageData = Get-VBOUsageData -Organization $Org

    # Need to handle the fact that a customer can have data in several repositories

    foreach ($Usage in $UsageData) {

        $id = $([Guid]::NewGuid().ToString())

        $UsedSpaceGb = [MATH]::Round((($Usage.UsedSpace) / 1024 / 1024 / 1024), 1)

        $Udoc = [pscustomobject]@{

            id               = $id

            Date             = $Date

            RepositoryId     = $Usage.RepositoryId

            UsedSpaceB       = $Usage.UsedSpace

            UsedSpaceGB      = $UsedSpaceGb

            OrganizationName = $Usage.Organization.DisplayName

            OrganizationMSID = ($Usage.Organization.Id.Value).Split(":")[0]

        }

        $Udocument = $Udoc | ConvertTo-json | Out-String

        # Writing data to CosmosDB

        New-CosmosDbDocument -Context $cosmosDbContext -CollectionId $CosmosDBCollectionID -DocumentBody $Udocument -PartitionKey $id -Encoding UTF-8

    }

}

The third query will get information about the repositories defined in Veeam Backup for Microsoft 365 and upload this in JSON format to the Cosmos Database. The original data values from the queries are in bytes format.

# Get VBO Repositories, convert to JSON and upload to CosmosDB

$CosmosDBCollectionID = 'VeeamBackupRepositories'

$Repositories = Get-VBORepository

$Date = get-date -Format "dd.MM.yyyy"

$RepositoryOutput = foreach ($Repo in $Repositories) {

    $id = $([Guid]::NewGuid().ToString())

    $RepoCapacityTb = [MATH]::Round((($Repo.Capacity) / 1024 / 1024 / 1024 / 1024), 1)

    $RepoFreeSpaceTb = [MATH]::Round((($Repo.FreeSpace) / 1024 / 1024 / 1024 / 1024), 1)

    $Rdoc = [pscustomobject]@{

        id                    = $id

        Date                  = $Date

        RepositoryId          = $Repo.Id.Guid

        RepoName              = $Repo.Name

        RepoPath              = $Repo.Path

        RepoCapacityB         = $Repo.Capacity

        RepoCapacityTB        = $RepoCapacityTb

        RepoFreeSpaceB        = $Repo.FreeSpace

        RepoFreeSpaceTB       = $RepoFreeSpaceTb

        RepoRetentionType     = $Repo.RetentionType

        RepoRetentionPeriod   = $Repo.RetentionPeriod

        RepoRetentionFreqType = $Repo.RetentionFrequencyType

    }

    $Rdocument = $Rdoc | ConvertTo-json | Out-String

    # Writing data to CosmosDB

    New-CosmosDbDocument -Context $cosmosDbContext -CollectionId $CosmosDBCollectionID -DocumentBody $Rdocument -PartitionKey $id -Encoding UTF-8

}

These different Powershell parts are coordinated and scheduled to run as powershell scripts on a regular basis on the Veeam backup servers.

  <Actions Context="Author">

    <Exec>

      <Command>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Command>

      <Arguments>-ExecutionPolicy bypass -file "C:\Simon\CountVeeam365LicensesDailyToPowerBI.ps1"</Arguments>

    </Exec>

  </Actions>

PowerBI data analyzis

Using PowerBI Desktop, it is easy to connect to the Cosmos Database. With the data loaded into Microsoft PowerBI you can do further manipulations of the data using DAX queries. One example could be to calculate the difference between capacity and free space for the repositories in order to get the used space pr. repository. This could be done like this which will return a separate column with the result ready to use in the report:

RepoUsedSpaceB = CALCULATE(SUM(VeeamRepositories[RepoCapacityB]))-CALCULATE(SUM(VeeamRepositories[RepoFreeSpaceB]))

I have also made a calculation of consumed GB pr user in each company. This is done in two steps. First I calculate number of users pr. company:

AntallBrukere = DISTINCTCOUNT(VeeamLisenser[Bruker])

Then I calculate consumed GB pr user in the company:

GBprBruker = SUM(VeeamUsage[UsedSpaceGB])/Kalkulasjonstabell[AntallBrukere]

Using Power BI we can easily create several reports to visualize the status of the service.

Example of monthly report of all companies and users protected by Veeam 365 Backup which can be the basis for invoicing where this is based on the number of users in the system pr. company.

Example of historical development of backup up users pr. company by Veeam 365 backup.

Example of gigabyte compared to number of users pr. company protected by Veeam 365 backup.

Example of usage of the calculated column for GB pr User. Infinity comes from stored data for customers which have terminated their contract where data still exists. This has been removed from the graph with a visuals filter displaying only companies with more than 0 users.

Example of report for repositories with forecast in the Veeam 365 backup service.

This gives a fully automated always up to date reporting solution showing current usage and historical development related to the provided service, license usage and storage consumptions. The reports can easily be filtered by clicking on the values and graphs giving the consumer of the reports the ability to select the desired view. 

The animation is blured to protect the data exposed in the report

If you upload your PowerBI report to the online PowerBI service, you can set the dataset to automatically update directly from the Cosmos Database. This will allow for online consumption of the report from all your devices. One idea could be to add it as a tab in a suitable team channel in Microsoft Teams giving easy access for everyone interested in the topic.

I do believe someone could have interest in the PowerBI Report file, but unfortunately this can't be shared because my reports contains PII data. 

Conclusion

I hope this could inspire someone to dive into data capturing and report building. If you have thoughts, ideas, comments or ideas after reading this far, please add a comment.

Good insights in Microsoft license usage

Cloud based IT solutions does have a pretty predictive cost when each and every license is based on a price pr user pr month. This should make it easy to budget the cost of each user role. The challenge might be to have an up to date overview of the license portfolio, both current and over time.

In order to give automated insights to the license situation, I have made a solution which has been installed at several tenants. Based on Microsoft Graph API powershell queries for running in Azure function apps, I am populating license information data from user accounts to a cheap Azure Cosmos DB. These data are then connected to PowerBI where I have created a report giving a detailed insight to the license portfolio pr. company, department, user. The report which can be granulated on year. quarter, month, week or day gives an accurate insight to the consumption of Microsoft licenses in the tenant, which helps address any misconfigurations.

The report has several pages, where the first page gives an overview over license consumption based on company/department with both a graphical and detailed table overview as well as personal details. The report can easily be filtered by clicking on the values in each part of the report.

Click for a larger version

Page two of the report has got a timeline showing the development of Microsoft licenses over time. The report can be filtered by company/department, license or user. This gives an insight to license usage which can't be found elsewhere. The picture below is an example where you clearly can spot a change in SKUs on a large amount of users over time. 

Click for a larger version

In some cases there has been developed even further report pages in order to address the need of insights to the usage of Microsoft licenses, and these reports have several times been used to detect misallocated licenses which in turn have resulted in significant cost savings over time. An example of such report could be the one including groups used to assign licenses to the user accounts.

Click for a larger version

Regarding costs for running the function and cosmosdb in Azure, they seems to be reasonably low. A typically SMB company with arround 200 users shows cost arround 5 NOKs for one month. 

Please let me know if you find this kind of technological usage interesting.

Corporate Headshots - Social Media for Business

First impressions will always be important, but now that we conduct so many of our initial interactions online, virtual personal branding has become as important as the firm handshake once was in introducing yourself to the world. Hence a corporate headshot is an opportunity to portray a brand image to potential customers.

In business we spend a lot of money on branding across logos, websites, literature, packaging and premises. Is the photographic representation of you and your coworkers the place to scrimp on branding? Probably not. Whether you are posting your headshot on you Companys website, or want to post it on social media pages, you are always representing your business in one way or another. A professional headshot will put confidence into you business and make your clients more willing to deal with you.

Think about it for a moment - if you were searching for a new supplier and found that a certain company was a very viable supplier, but the corporate headshots had an unprofessional style - would you be willing to deal with this company? If you want to get the most out of your digital presence, a professional corporate headshot will allow you and your colleges to achieve a good appearance.

Getting the most from your head shot

If you decide to make corporate headshots of you and your company, you will have to deal with a lot of questions related to dress codes, style of the images etc. You need to book a photographer and put up a schedule for your co-workers to get photographed.

Me doing corporate headshots of  a company

Pictures received - now what?

Once the photo session is finished you will receive a portfolio of pictures from the photographer. Now you need a plan how to distribute and use these pictures in order to give the best return of Investment.

Corporate Headshost received - time to distribute and use the pictures

Social Media has been a large consumer of headshots for a long time. We have also seen headshots as impersonators in corporate software for a while. The challenge now will be to utilize the new portfolio of headshots over the wide array of software og systems supporting personal portraits.

Active Directory, Exchange and Skype for Business

Portraits can be added to each user account in Active Directory as a thumbnail. There are several tools available for this operation out on the wild internet. We have preferred a PowerShell script to deal with this operation. Pictures are being adjusted and exported to a folder in the format of sAMAccountName.jpg. The Powershell script will then add the corporate headshot to the correct person in Active Directory. The debut of Exchange 2010 and Outlook 2010 made the portrait from AD available in Exchange Global Address list. All out of sudden the new headshots are available in the Outlook clients to all employees in the company.

Corporate Headshots available in Exchange and Outlook

The thumbnails uploaded to Active Directory will also be visible for colleagues in Skype for Business:

Corporate Headshots as viewed in Skype for Business

AD-integrated thumbnails in Skype for Business will only be visible to internal users. Federated users will not have read access to the picture stored in Active Directory. In order to make your thumbnail portrait visible to federated partners you need to tweak your Skype for Business to allow pictures from a website. With this option available we can pick a portrait available on the Internet as a thumbnail photo in Skype for Business.
In order to have a streamlined distribution of the corporate headshots, we have created a website on the Skype for Business server with all headshots available in correct format. The website is populated with images from the same Powershell script populating AD with thumbnail photos. This will give all users a Skype for Business uniform corporate portrait visible to everyone - internally and externally!

Example of Skype for Business meeting where pictures of federated users are missing

3rd party systems

The Powershell script used for distribution of the corporate headshots can easily be customized to distribute pictures to other 3rd party systems. The following list contains examples of 3rd party systems where the powershell script has been used for picture distribution.

Trio Enterprise

Trio Enterprise has options to have corporate headshots for each individual person registered in Company Directory. Company Directory can be set to synchronize with Active Directory, but the thumbnail photo from AD can't be directly synced to Company Directory. By customizing the PowerShell script for distributing the corporate headshots, we have managed to incorporate Trio Enterprise into the automated picture distribution. Here are some examples of pictures as they appear in Trio Enterprise:

Corporate Headshot in Trio Enterprise Attendant

Corporate Headshot in Trio Enterprise Web Assistant

Corporate Headshot in Trio Enterprise Web Assistant

Web based solutions

The pictures has also been distributed to 3rd party web based solutions with information based on AD giving phone lists, employee lists, organization charts, doorsigns etc. These are handy tools for new coworkers in the company to match names and faces. Some screenshots just as an example:

Organization Chart with headshots

Department list with headshots

Title list with headshots

User information with headshot

Doorsign template with headshot

Contact Card VCF file

The best way to distribute your contact card in a digital way, is by use of VCF Contact Cards. These cards can in fact also contain a portrait. This will effectively distribute the new portraits and updated personal details to your contact persons outlook and mobile phones. The PowerShell script used to distribute the Corporate Headshots can also distribute pictures to be used in a VCF Contact Card routine. I have earlier described a routine for setting the Outlook Auto Signature based on details in AD. This has in some circumstances been extended to give a shortcut to an downloadable VCF file with appropriate updated contact details - included a fresh user portrait!.

Outlook AutoSignature with shortcut to updated VCF file



VCF file with updated details and corporate headshot

Windows 10 Profile Picture

Some fantasy and creative use of PowerShell and Group Policy can also automatically distribute the Corporate Headshots from AD as profile picture in Microsoft Windows 10.

Corporate Headshot as profile picture in Windows 10. ScreenLock background is also centrally managed.

Corporate Headshot picture in Windows 10

Office365

Microsoft Office 365 has Corporate Headshots heavily integrated in all services and modules. We have expanded the Powershell script to distribute the corporate headshots also to this platform. This gives the platform an extra social profile.

An example of corporate headshots in Delve from Microsoft Office 365

Corporate Headshots and other graphical branding through scripting

Scripting and customization of your standard products used by your employees on a day to day basis can take your branding interests to a higher level. This blog post has focused on corporate headshots. It could have been considerable longer if I did include other graphical branding possibilities available in your standard products in use at the office. 

A security concern!

Please do remember - these are small steps helping you increase your security since it will give your services a branded look which differs from standard solutions!

I would love to help you with these concerns! Please comment if you have a good story, some needs or experience related to this topic!