Keep Customer Microsoft 365 Documentation Current in Syncro Without Touching It

Documentation is the work everyone agrees matters and nobody keeps current. Writing up a customer's Microsoft 365 environment is tedious; keeping that write-up accurate as licenses change, MFA gets reconfigured, and devices come and go is a job that quietly never gets done. The result is documentation that was true the day it was written and misleading every day after. The way out is to stop maintaining it by hand.

These scripts automate and update documents in Syncro that are tied to your customer environments. Together they handle:

• Microsoft License Information => displays all current licensed and unlicensed users, plus what licenses are available versus consumed
• Microsoft MFA Status => displays MFA status, Conditional Access policies, and DUO MFA custom controls
• Microsoft Exchange Information => displays mailbox usage in GB, last login time, mail flow rules, DKIM config, and ATP policies
• Microsoft Intune Information => displays enrolled devices, compliance status, OS version, Autopilot info, encryption, and assigned apps
• Microsoft Contact Creation => creates a contact on the customer record in Syncro for active 365 users

All documentation is listed for the customer, and contacts are automatically added or updated on the customer record.

Every script is published in the Syncro-Documentation repository on GitHub (opens in new tab).

The Microsoft license report#

The license report displays all active and consumed licensing, plus every licensed and unlicensed user. It is also available as a standalone license report walkthrough if that is the only piece you want.

The MFA status report#

This report shows every user's MFA status. Because Microsoft has evolved MFA registration over time, there are, as of April 2021, three different ways a user could have MFA enforced:

• Legacy MFA portal (where you see Enabled, Enforced, Disabled)
• Conditional Access policies
• Security Defaults

For that reason the report includes two columns showing whether a user has registered through one of these methods. Security Defaults and Conditional Access registration appear in a combined output. The report also lists the names of all Conditional Access policies and an additional field showing whether you have DUO listed as a custom control in any Conditional Access policy.

The Exchange report#

The Exchange report shows mailboxes, active consumption in GB in descending order, last login time, mail flow rules, DKIM configuration, and ATP settings and policies.

The Intune report#

The Intune report contains a summary of device compliance, devices, and all apps that are in an assigned state.

Microsoft contact creation#

Microsoft 365 users are created as contacts for a customer if they do not already exist. If a user is no longer in 365, a note is added to the existing contact to say they are no longer active. At the time, Syncro had no flag for this, so a note was the cleanest way to show a user had been removed.

What you need before you start#

You will need tokens and GUIDs from both the Secure Application Model and Syncro. The Secure Application Model is what allows a headless connection into all of your customer environments. The script to set it up comes from Kelvin at CyberDrain: the Create-SecureAppModel script on GitHub (opens in new tab).

In Syncro, create a new API key with permissions to customers and documentation so it can perform the necessary read and write actions. Syncro's documentation on generating an API key (opens in new tab) covers the steps. The only other variable you will be prompted for is your Syncro subdomain, which is simply the prefix of the URL you sign in at.