john zuh's questions

Could it be that Firefox doesn’t support all windows NTLM SSO scenarios on a Sharepoint Site via adfs? Login attempts into Sharepoint site just gets stuck on the login page and nothing happens afterwards… I enabled Windows SSO gpo, not sure if that was needed.I also activated the following policies below but nothing changed.

Added the Sharepoint Site address used by my users to access the internal SPR or federation Server sites, not sure if additional addresses will be required.

• network.automatic-ntlm-auth.trusted-uris
• network.negotiate-auth.delegation-uris
• network.negotiate-auth.trusted-uris signon.autologin.proxy to be true

Or I need to set

• activate security.enterprise_roots.enabled

If I am using an internal CA in order to use trusted roots certs from Windows though not tried that yet.

Or something like this needs to be activated the server side i.e. federation server => https://cloudrun.co.uk/adfs/single-sign-on-ssowith-chrome-firefox-and-adfs-4-0/

Surprisingly enough this same Sharepoint site works flawlessly on an alternative Edge chromium browser after testing on it.

We are have planning to migrate our Files to Onedrive4B and as part of the requirements we have been asked to Redirect Known Folders to Onedrive in our case (Desktop, Pictures and Documents). Our Documents is redirected to H: Mapped Network Drive so whatever is saved in Documents is synced via the Microsoft Sync Center back to H: Network Location whenever the client is in online mode.

Our Onedrive Group Policies look like this

The Challenge here is since our Documents Folder (which is part of the known folders) is not on the local Machine but in a network location how do we handle this?. We noticed that it was not possible to backup the Documents folder, OneDrive will refuse telling me that "The Documents folder contains other important folders and isn't supported for file protection." Contact your IT Department or something. Similar Description here https://onedrive.uservoice.com/forums/913534-onedrive-security-policy-administration/suggestions/35072257-allow-onedrive-kfm-to-work-with-folder-redirected

This is how the Folders look like when trying to backup Onedrive for Business

So in order to give Onedrive access to my Documents on the local System the plan was to disable Folder Redirection using GPO.

So I did this in a separate group policy which precedes the group policy with all Onedrive settings. https://4sysops.com/archives/how-to-disable-folder-redirection/

I still didn't see a behaviour change or option deactivated even though corresponding registry key is updated on computers after a policy update. I checked the following location https://www.winhelponline.com/blog/windows-10-shell-folders-paths-defaults-restore/

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Shell Folder Name — Value type: REG_EXPAND_SZ: Personal Location: %USERPROFILE%\Documents

I found an interesting article here https://lazyadmin.nl/office-365/migrate-users-home-drives-to-onedrive-for-business-with-powershell/ that seem to be talking on the same lines but i am not too sure if this is the way to go.

Some recommendations could help

Due to the Data Privacy regulations in our Country we have been asked by management to disable Microsoft Office Pro Plus, 365, 2016 from sending Telemetry Data to Microsoft so i did the following as stated on the official website https://docs.microsoft.com/en-us/deployoffice/compat/manage-the-privacy-of-data-monitored-by-telemetry-in-office .

So I downloaded ADMX templates > Configuration > Administrative Templates > Microsoft Office 2016 > Telemetry Dashboard and did the following in order to disable Telemetry Agent policy settings that disable logging

TO STOP LOGGING BY USING THE GROUP POLICY SETTINGS

Setting

Turn on telemetry data collection

Set this setting to Disabled to turn off data collection.

Turn on data uploading for Office Telemetry Agent

Set this setting to Disabled to stop uploading data to the shared folder.

According to Microsoft if logging is deactivated folder this %LocalAppData%\Microsoft\Office\16.0\Telemetry folder does not exit. I double checked on one of our test clients and truly that path doesnt exist.

Nevertheless my attention was then drawn to another location %localappdata%\Microsoft\Office\OTele. Check out this article https://www.gruppenrichtlinien.de/artikel/office-20162019365-telemetrie-deaktivieren-disabletelemetry/

This location also logs some kind of Office Telemetry Data and it gets populated anytime office is active. Is this location relevant? If so how do we stop it from logging office Data?

Reference link: https://social.technet.microsoft.com/Forums/office/en-US/f98dd521-fc45-4187-af30-f00031585f44/disable-microsoft-office-telemetry-not-working-properly-data-logging-locations-very-confusing?forum=Office2016ITPro#f98dd521-fc45-4187-af30-f00031585f44

We are in the process of Integrating a third party MDM (on-premise) with Autopilot in AAD portal to enable Windows 10 OOBE. We want to achieve this by leveraging an on-premise Core Enterprise Application server in Azure. We have configured the following so far which is not working as expected. Also Can't find any relevant event logs within "User Device Registration" or "DeviceManagement-Enterprise-Diagnostics-Provider" :

The Autopilot Device Profile was created by importing ID into Autpilot. Security Group with authorised users incl. MFA enabled Authentication Redirect URIs was also configured in MDM App used by Azure AD to join Web App via corresponding client_id which maps one of Azure DRS. Terms of Usage URLs plus secret keys was also created. MDM DISCOVERY URL & MDM TERMS OF USE URL are correctly set but havent checked if they are accessible over the Internet NB: All of the above and a host of other requirements was double checked and tested several times. Device is able to enrol when InTune is used as the MDM server (by adding the InTune application to my Azure AD)

A Test Device out of the box was used to run the following test scenarios in Azure with an E5 incl. mdm + security subscription.

During our tests we got the following error:

****> we are not able to enroll Azure AD due to : Redirect UI

[https://login.microsoftonline.com/WebApp/CloudDomainJoin/10] is not formed correctly**** After some googling i read this could be caused by DNS issues, outbound proxy issues, or a variety of other reasons.

I also read this can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. We might have sent the authentication request to the wrong tenant but checked this with a colleague today and granted all necessary permissions as required. Didnt do the trick

I also read this could simply be due to a general Authentification Failure which still looks very generic to me.

Anyone has any clues on how to troubleshoot these kinds of problems based on the error reported. Tips Will be very much appreciated.