Sunday, 13 January 2019

Using Box.com Pragmatically

Overview:  In the SaaS Document Management space Box.com is a competitor to SharePoint Online.  A medium size client request recently came into integrate with a client and deliver files into Box.com, as it is something I have not done before I was eager to see how easy it is.

Requirement:
  1. I merely need to create folders within the clients tenant if needed and drop files into specific folders from a scheduled job that runs every 5 minutes.  
  2. Box.com has API similar to SharePoint CSOM to pragmatically work with your Box tenant.   
  3. Box.com functionality is specific to Documents so the API is really small and easy to learn.
  4. There are multiple ways to pragmatically authenticate to you Box.com tenant, PoC keeps it simple.  Actual must use JWT for the connecting service account.
Implementation Details:
Box.com has several was to problematically connect and to test the API's.  For my PoC I used the Developer Token approach.  We should switch this over to the JWT OAuth approach but for the PoC and working with the API's I used the Developer Token approach.
1. Once you tenant is setup and you have configured your client, set the developer Token that last for 1 hrs as shown in the screen above.
2. Create a new C# console and add the Box C# SDK reference as shown below.
3. You will need to add the Developer Token, Client Secret and ClientId in order to programtically connect from the console.  Below is my app.config.
<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <startup> 
        <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.1" />
    </startup>
  <appSettings>
    <add key="ClientId" value="f9y555fiqwqcbv555lst88dmzbxzqa7n"/>
    <add key="ClientSecret" value="CoTT555U7oN555wKF555aPYz5555"/>
    <add key="DeveloperToken" value="TjxJh555ivvW555EE555NTerb555"/>
  </appSettings>
4. Connect to your tenant using Box.com's API's/ SDK

5. Run the Console and the console looks as follows:
6. Code the file upload logic:

Final Thoughts:

  • Overall I think Box.com is a good option if you don't already have O365.  It's pretty expensive for a small feature set but it is a valid option for clients.
  • The search indexing is ridiculously slow so very hard to build search based solutions using the API.

Thursday, 10 January 2019

NoSQL Document Database options on Azure - CosmosDB

Overview: Azure has a plethora of options for using NoSQL, I have used RavenDB and DocumentDB a couple of years back.  Both are easy and great tools for the right situation, DocumentDB now falls under CosmosDB as a product at Microsoft. However, I feel that CosmosDB would be anyone's default choice today on Azure as DocumentDB is really a feature subset of CosmosDB.

CosmosDB"Azure Cosmos DB is a global distributed, multi-model database that is used in a wide range of applications and use cases. It is a good choice for any serverless application that needs low order-of-millisecond response times, and needs to scale rapidly and globally."  CosmosDB is used by Microsoft's Skype, MSN, Xbox, Office 365, Azure products.

  • Encrypted on Azure at Rest and in Motion.
  • Multiple API's supported including SQL API (DocumentDB) and multiple other JavaScript and Table.
  • Logica breakdown of CosmosDB API
  • Partitions are managed transparently and users are routed based on geographic location and usage

Concerns:

  • Determinant geo-replication - Use to be 1 master and multiple read copies of the data.  Not all copies can be written to but if you have country data residency rules you can't configure data to be within specific regions.  I.e. I can't specify certain bits of data are only stored in a specific region.  You can specify a region/location for a container, but not split a container.   : Check!  Not fact.
  • Backup and Recovery - Point in time recovery and MS ticket needs to be raised.  Can't structure complex backup plans.  Take it or leave it approach.
  • Limited LINQ support
  • SQL API is very limited, offering no joins or aggregation capability such as GROUP BY.
  • Temporal Tables don't exist, there are good auditing options such as the "Change Feed" where all changes can be streamed into an external database/system.
  • Entity Framework support is limited so be to PoC.


More Info:
NoSQL options - https://www.nebbiatech.com/2017/02/09/exploring-the-nosql-options-on-azure/

Sunday, 16 December 2018

SharePoint Online Property Bag SPWeb Properties are not indexed by default

Problem:  Moving an on-prem SharePoint solution to SPO, I realised that SPO does not automatically index property bag values.

Initial Hypothesis:  The Search schema looks correct and automatically created the correct Managed Properties.  Asked our Microsoft representative and they sent us a link to enable property bag values in the search index.

Resolution: Be aware that you need to do some Powershell commands on your tenant and site collections when using SharePoint Online to make property bag settings appear in the search results.

More Info:
https://blog.kloud.com.au/2018/04/26/how-to-make-property-bag-values-indexed-and-searchable-in-sharepoint-online/

Saturday, 15 December 2018

ShareGate User Migration Gotcha

Problem:  Migrated an Extranet site with a large user base, and multiple users have the same name.  When a user is removed from AD, and running migration to the new farm, the AD automatically picks a different user and gives them the user that lefts permissions.

Example:
John Smith (john.smith@contoso.com) has been added to a site collection.
John Smith (@contoso) is removed from AD but still exists in the site collection permissions.
Ran Sharegate to move the content including user permissions to a new farm.
John Smith is added to the same SharePoint groups however, it has added john_smith@clientA.com

Initial Hypothesis: Sharegate tries to resolve the user and is incorrectly resolving the user's name and not the name in AD.  As the user has left the firm, the other user is being resolved and we end up with permission inconsistency.

I got this reply from Sharegate and can see that my issue happens at step 8.

"How Sharegate resolves users from the source to the destination"

"We look at the whole account name available, for matches to users at the destination through the SharePoint people picker.
Once we have a list of potential matches for your user, we go through the list of values below (in the specified order). We consider the account a match when we find the same values for one of these properties:
1.    Exact same account name
2.    Same normalized account name (without claims header)
3.    Same login and domain
4.    Same login
5.    Same login and domain (source login read from display name - this can happen when importing from file system because the account name is set as the display name)
6.    Same login (source login read from display name - this can happen when importing from file system because the account name is set as the display name)
7.    Same email address
8.    Same display name

9.    PrincipalType is not set or is a Security Group and same display name without domain"

Somewhat related:
https://sharegate.com/blog/unresolved-user-when-preserving-created-modified-sharepoint-migration

Monday, 3 December 2018

SharePoint Online Geo-Replication 065

Geo-replication/Multi-tenancy - WIP

O365 is moving towards multi-tenancy that will allow multinational companies to store data in compliance with country rules.  For instance EU data may not be allowed to be stored outside the EU but you already have your O365 tenancy based in the US.

Historically, most larger companies have chosen either the US or EU to base their data storage in.  If you wanted data to be stored in another region you had to buy another tenant with Microsoft strongly discouraged. 

Microsoft, are working towards supporting O365 in multi geo-locations.  Basically, their are 2 parts: 1) User specific data (email, OneDrive) where we know where a user is based and their data is encrypted and stored in that country. and 2) group/team/country specific data (SharePoint) where the data itself may have residency rules.

This post looks at SharePoint data that is required to be stored in a specific country.

Options today:
1. On-Prem. : Have a SharePoint farm in each geo location, this requires a fair amount of thought to deal with SSO, Search, MMS, Content Types and UPA.
2. O365: Have multiple tenants (non are connected) in each location and connect your authentication up to each tenant.
Coming Q1 2019 : Multi Geo tenant, that will pretty much be the same answer as on-prem. mentions above with a couple of smart improvements, namely search, they shall intermingle results in a single result set if required whereas federated search is the closest we have in.  A lot of this is in the private preview so I'll update this post once we go live.


Sunday, 18 November 2018

Securing SharePoint O365

WIP 

Azure AD is the key, ensure auth is 100%.  e.g. MFA for some or all accounts.  Use the "Identity Secure Score" to check possible problems.  Consider Microsoft Authenticor for MFA.

O365 Settings use:

  1. Secure Score - Overview of my tenant settings and how they should be set.  Check my tenant again set MS best practices for O365. 
  2. Validate setting meet governance and are not merely defaults.
  3. Review SPO audit logs - ensure it is turn on (default is to have it turned off).
  4. Security and Compliance Dashboard - Good email checker/analysis.  Low value for SPO.
Cloud App Security - service looks for security on O365 tenants, improving constantly.




Saturday, 8 September 2018

SharePoint Saturday 2018 - Cambridge

Here is my slide deck from SharePoint Saturday Cambridge 2018  Introduction to Azure Information Protection (10 MB includes recordings)

1. PowerApps Jump Start by Sandy Ussia
I know PowerApps fairly okay and I got some useful pointers in this session.
2. Office 365 Security and Compliance with Albert Hoitingh and Daniel Laskewitz
This was 2 sessions and amazing.  Hands-on how it works and what I need to know.  Absolutely brilliant double session.
3. Managing Content in O365 with Erica Toelle
I did not know Erica, I do now!  And wow she is good, she covered O365 security center, Cloud App Security (new service looks for security on O365 tenants) and AIP.  Great knowledge, humble and so easy to talk to.
4. My presentation on AIP
5. Containers with Anthony Nocentino
Amazing presenter - very engaging and I learnt a lot about containers - not really my world but learnt a lot.

A great conference, well organised - the sessions info were outrageous.  The speaker's dinner in Sidney Sussex College was quite an experience.  Thanks to the organizers:
Paul Hunt, Mark Broadbent, & Andy Dawson