Microsoft Flow is a cloud-based platform for business process automation, which allows an Office 365 tenant user to build elaborate workflows and integrate numerous sources using connectors to Office 365, Azure, third-party vendor platforms,  gateways to on premises servers, as well as custom connectors or HTTP requests to virtually any external service.

In this article we will focus on its ability to replace legacy SharePoint Designer workflows. As a proof of concept we migrate a  SharePoint Designer 2013 approval workflow to MS Flow and highlight the key differences and challenges.

The SP 2013 solution

The solution has the following main components

• a SharePoint custom list allowing end-users to create an expense request for approval to the management
• a Sharepoint Designer 2013 workflow, triggered by the “on create” event
• a SharePoint workflow task list, and two custom content types, “Approval task” with actions Approve/Reject/Rework and “Rework task” with actions Cancel/Resubmit
• a SharePoint custom list of “Executive approvers” who are the final approvers in the approval flow

A request  submitted  by a user contains general information about the request (title, ID, description, amount) as well as approvers designated by the requester (like his general manager, local unit manager…). Some of the designated approvers are optional.

Every request passes sequentially through up to 6 approvers before it gets approved.

• Whenever an approver rejects a request, the request gets the status “rejected” and the workflow ends.
• If all approvers approve an item, the request gets the status “approved” and the workflow ends.
• If one of the approvers requests a rework, the user has the ability to cancel his request or rework it. In the last case the approval starts all over again to approver 1.

The requester gets an e-mail confirming whether his request has been accepted or rejected and a task if his request needs rework. All tasks also trigger a mail alert by default to their assignee.

The main building block of the workflow is a loop which goes through all the approvers, assigns a task to each, waits for the result, and if the results is not “approved” it breaks the loop to step into the alternate stages.

The MS Flow solution

In MS Flow our solution contains these components

• a flow with the main business logic
• some variables
• connections to services, in our case SharePoint Online and Outlook Online
• actions on SharePoint Online and Outlook Online
• a trigger from SharePoint Online

Editing

Editing a workflow in MS Flow is simply a matter of going to the MS Flow app under the O365 app launcher and switching a flow to edit mode. No need to install an app or plugin, the environment is also fully compatible with all current browsers.

The user interface is slick and fluid, yet there are some limitations at this time, here are some we experienced:

• When you create a flow with a lot of switch/case or parallel conditions, the graphical representation becomes quite wide (zooming in/out with your browser can help), and it becomes cumbersome to move horizontally between portions of the flows, also the browser doesn’t always get it right when to display the scroll bar.
• Text fields (like mail body fields) trigger an interpretation of your keystrokes, and this can cause some delays, typos and/or mess up your text when mixing static and dynamic values. Also some fields support HTML encoding and some not, which is not clearly documented or indicated.
• There is no way to copy paste, both within a flow, nor between flows, you can however do a “save as” and continue working on a copy. Also you could in theory export a package and then copy a part of its code which is stored in a JSON file format.
• There is a lack of help or guidance when entering an expression, the documentation on this topic is rather basic, so you end up doing a mixture of searching on the web (check the links section) and some trial and error attempts.
• Specifically for SharePoint, when updating an item in a list you are forced to provide all data for required fields, there is no action to update a single field. Also the integration of MS Flow solutions in SharePoint is limited, in the modern experience the Flow features are simply links to the Flow environment, there is no integrated interface for managing or manually starting workflows like SP 2013 workflows.

For keeping an overview of a long workflow, a good practice is to group as much as possible actions together with “scopes” (grouping actions) with a distinctive name. There is also the possibility to comment your code in every action.

Some tips if you plan to work with SharePoint (custom) lists:

• When you make changes to the (list) content type, these changes are never directly reflected in MS Flow, not by re-selecting the list in the SP actions, not by switching edit mode on and off; you need to close your flow, then in the flow overview page (where you see the run history, connections, owners, …) go back to editing, you’ll see the changes.
• If you use a lookup field in a list where you want to update items, it will report a failure on update if you use “Title (linked to item)”; curiously the issue doesn’t occur when creating an item, and even while it reports a failure it actually successfully updates the item (but can cause your flow to stop). If you want to avoid the failure report use plain Title or any other field.

Triggers and overall logical buildup

The starting point for every workflow in MS Flow is a “trigger”, an action initiating the workflow, this can be any event coming from any connected service that you can subscribe to. Alternatively, this can be a schedule executing the flow on a defined frequency.

In our case we want to start the workflow whenever a new item is created in the SharePoint request list, but also when an item needs a rework.
In SP 2013 we would use the “on created” event, if the requester asks to resubmit, the workflow can simply go back to the initial step without the need to restart.
However MS Flow has no “go to” or “go back” so we need the be able to capture the “on update” event as well. So in the case of a resubmit, the request gets updated by the flow and a this triggers a new execution of the flow on the request.

Be aware that capturing a larger scope of events (both creates AND updates) has an impact on the quota of runs allowed in your MS Flow plan. As of writing of this article, the free plan of Flow that comes with O365 enterprise licenses allows up to 750 runs per user or 2000 per tenant. Above that amount of runs you’ll need a paid plan. Check the link section below for more information. Also note there is currently no way to detect the number of runs in the free plan (other than by noticing when a run fails, or by downloading the run history).

As we initially used the “Create” trigger, at some point we needed to change it into the “Create and update” trigger. In SP 2013 you can simply check or uncheck the different startup options (manual, on create, on update). A current limitation of MS Flow is that you can’t easily change a trigger. As soon as you are using data from your trigger in your workflow, your trigger is implicitly attached to your flow and it can’t be removed and replaced. The editing menu of your trigger will show this message:

The reason is: as other actions in your flow depend on its input, the flow would break. If your new trigger uses the same connection and you don’t want to recreate the full flow from scratch, there is a workaround:

• export the workflow as a zip package (option “create as new”)
• make sure to rename the original workflow to avoid conflicts when importing
• unzip the package file, look for the definition.json file
• replace the trigger by editing the file:
  in our case we replaced “When_an_item_is_created” with “When_an_item_is_created_or_modified” , “GetOnNewItems” with “GetOnUpdatedItems” and “onnewitems” with “onupdateditems”
• recreate the zipfile (make sure the Microsoft.Flow folder is in the root of the zip file
• import the package, the flow is now triggered by the new action

Variables

Since the user has the ability to edit his request during the flow (and our approval process can take up to 3 or 4 weeks), we first store all the request data into variables that we’ll use during the flow. This way we avoid that the data changes during the flow execution.

Also we can store some tenant related data like an url of the site collection in one place instead of in all the the connector actions that depend on it. If we move the flow later to a different environment (eg. from test to production) we only need to change a few variables.

Finally, storing the most important data in variables has the benefit of  having them suggested as first when entering dynamic data, so you don’t need to scroll or search in a lengthy list of data from all the connections and actions.

Approval

Approval in MS Flow is accomplished either by Approval Tasks or Approval Mails.

Approval Tasks reside in the MS Flow itself and are visible under the Approvals tab.

When you use the “Start an approval” action, it adds an entry in this list and generates a mail notification to the assignee.

There is however a significant limitation at the time of writing, you cannot customize the list of actions, it is limited to Approve and Reject.

So for our case, as we needed Approve/Reject/Rework and Resubmit/Cancle, we decided to use the “Send an Approval Mail” action, which sends a mail with the customized list of actions included as link button. When clicking on one of the buttons, the approver is directed to an Azure page which sends the selected action to the flow (once an action has been activated, you cannot trigger the same or another action).

There is a drawback and an advantage to this action: if you include all relevant data in the approval mail, the approver doesn’t need to leave his mail environment to asses the request and perform the appropriate action, this in replacement of the SP 2013 approval experience, where the user has to click on the link to the item, edit it, select an action and save the item (or click on an action button). Replacing all these steps with a single click is an appreciable improvement in terms of user experience.

The drawback is that you have no trace of the approval that are open, nor in Flow nor in SharePoint, so we ended up building a feature into our flow, which adds approval “reminders” in a custom list.We cannot include however the actions from the mail into this list, so the mail is the single point of failure for the process. In our case there are no external mailboxes or -environments involved so the risk is rather limited.

Tracing

There is no tracing feature builtin MS Flow, so you’ll have to use either an 0365 repository (custom list) to trace your actions from within Flow, or for a more enterprise solution store all traces in Azure Service Bus where they can be processed by any subscribing service.

User Account

A final note on the user account running the flow. You can have different accounts for the main flow and the connectors, so your flow identity and the one sending mail for instance can be different. It is however advised to use a service account for the execution of the flow, be aware that it will the necessary permissions to carry all the required actions in SharePoint and Outlook, as well as the licences to access those services.

Also if you plan to protect your user account with Multi Factor Authentication, there is no way to use an app password in Flow so you’ll end up having to refresh the authentication token on a frequent basis in the Connectors tab. If you have any connection failure frequently causing a flow to stop, MFA might be the cause.

Conclusion

With MS Flow now for over a year in GA release, we can conclude that it is a more than valid option to migrate your workflow to.

However, before moving an existing SharePoint workflow to this platform, we recommend to list your main business requirements (the “must haves”) and check these with a proof of concept. It will also help familiarize your customer with the way MS Flow works, since it is not part of the SharePoint stack, things like approval look different and and are managed out of the SharePoint environment, so it is better to make him aware upfront of the changes in the user experience.

Pros

In our  experience it looks more reliable and certainly faster than the SP 2013 workflow engine.

The learning curve is fairly shallow, with exception of the (advanced) expressions. The general buildup is and user interface is very intuitive. the community is now large enough to provide you will kinds of help.

There is virtually no limit to the possibilities of MS Flow when you start expanding in a platform like Azure functions, Web API, Azure automation, or extending it as a Logic Apps solution in Visual Studio.

With Connections (shared with another 0365 service called PowerApps) it is clearly becoming one of the key components of the 0365 environment, and “the way to go” for any workflow based solution in the Microsoft cloud.

Cons

The user interface has some issues especially for “long” and “wide” workflows, long text fields, it offers no ability to quickly copy paste or change your trigger …

The inability to group logic in steps and navigating up/down between these can be an issue for more complex workflows.

Custom tracing is (not yet) available.

The actions of the SharePoint connector have different (often more limited) possibilities than their SP Designer counterparts, always take that into consideration with a proof of concept; you can always workaround these limitations with SharePoint REST API calls or Azure functions but you’ll need to assess the complexity and effort of these workarounds. As the platform constantly evolves, it might be an unnecessary investment in a few months time.

Links

MS Flow pricing

https://emea.flow.microsoft.com/en-us/pricing/

O365 Power Users Forums

https://powerusers.microsoft.com

0365 UserVoice

https://office365.uservoice.com/

This year Spikes was represented by 12 “Spikees” at the European SharePoint Conference 2017 (#ESPC17) in Dublin, Ireland – or officially “European SharePoint, Office 365 and Azure Conference”. While we had a great mix of focus areas present, I mainly focussed on the IT Pro and business tracks. In this blogpost I will try to translate the highlights of the information I gathered over 3 days into a functional/business perspective.

Self service and digital transformation

“We still haven’t transformed, we’ve migrated.” @bniaulin at #ESPC17 pic.twitter.com/637cPtphp8

— European SharePoint (@EuropeanSP) November 14, 2017

The common thread throughout the entire conference contained 2 parts: a huge focus on Self Service and the Digital Transformation process almost every company still has to go through.

Self service

Why require intervention of the IT/support department when the business requests a collaboration space? Or when they want to involve external parties? Or need a solution for publishing transparent information to the organisation or a specific part of it?

All of the above (and many more) can be created by relying on self service. Of course, IT can play a role in helping provide the best corporate tools towards the business. It is also important that before “releasing” all of the corporate approved solutions, the exercise has to be made regarding governance, policies and (naming) conventions.

Digital transformation

A great statement during one of the key notes was “We still haven’t transformed, we’ve migrated!”. Basically, technology is evolving or has already evolved into self service, scalable, modular solutions, but the companies themselves need to be digitally transformed as well.

Apparently many companies do not understand that if they don’t provide the right solutions to their people/business, they will find a solution themselves. Often not a corporate governed solution without consistent data back ups and potentially unsafe with a great risk of data loss, also known as “Shadow IT“. And we all know the cost of data loss …

Now is the time to start your company’s digital transformation and avoid losing your best employees, gain a higher level of trust and data security and get IT and business to start working closer together. This will result into a secure modern workplace which contributes to productivity and employee happiness. Eventually, employee happiness will significantly increase customer satisfaction.

Spikes can help you deliver this secure modern workplace, involving business and IT from the start by generating awareness, helping understand each other and eventually help you build a digital, safe and modern workplace. https://www.spikes.be

Office 365 Groups

“Who thought that Office 365 Groups were actually the same as Outlook Groups?”

Almost 1600 attendees, including the amazing key note speaker Benjamin Niaulin, all raised their hand. This is actually how Microsoft presented Office 365 Groups until recently: a distribution list which initiates/configures other collaboration products to get your employees going in no-time. WRONG.

An Office 365 Group is an Active Directory security group – basically nothing more, nothing less. Moving forward, you can imagine it’s a burden for the IT/support department to create a communication channel, document workspace, task manager … manually, every single time a security group is requested. Setting up these collaborative services & products is being triggered by the creation of an Office 365 (Security) Group – that part hasn’t changed. But remember: it’s not and Outlook Group; it’s an AD Security Group which initiates other collaborative services & products.

It is clear that Office 365 Groups are here to stay!

Modern team sites

If you have been working with SharePoint for over a year or longer, it is impossible to imagine SharePoint without classic team sites/classic pages. They work fantastic for SharePoint gurus, hard core IT-ers and Power Users … not so much for business people. Microsoft therefore launched “Modern pages” which also are a part of the Modern team sites.

These Modern team sites have a clear focus on the business to build and self sustain these sites and pages from bottom up. Although the modern pages are fairly easy to set up and manage, it is a pain that certain web parts have disappeared, compared to the classic web parts. If you’re not a technical person, just be aware of the SPFx framework which can be used to build custom solutions and web part for. They even will be as responsive as the out-of-the-box ones. So in some situations, developers can still build custom “modern” web parts where the business or functional requirements don’t meet with the out-of-the-box solutions or web parts.

Sneak peak: “Groupify”: be able in the future to transform your classic team sites into a team site, linked to an Office 365 Group – easy membership management included!

Good to know: more and more Modern web parts are being released! We at Spikes have access to many Office 365 tenants. This means that if a web part has been released by Microsoft into their “First Release” network, we will look into it and make sure to test it thoroughly. Next, we provide our customers with proactive feedback on the use cases these web parts could be used in and their potential added value.

In case a Modern team site is linked to an Office 365 Groups (security groups; remember?) business users are also capable of managing the security setting with one or two mouse clicks: Site Owners or Site Members. In a nutshell: Modern team sites are much more focused on business usage and maintenance – big win!

It is clear that Modern team sites are here to stay!

Communication sites

Where Modern team sites mainly function as part of a collaborative space, sometimes all you need is some sort of a publication platform. This is where Communication sites come into the picture. Again, they are focused on business usage and maintenance where normally no interference of IT or support should be necessary.

A communication site knows many use cases, for example:

• Event site with announcements and photos
• Landing site for a portal/local intranet
• Public HR site with benefits
• Tire-change schedule/registrations
• Training overview with registration option
• …

Did I mention that all Communication sites and Modern team sites/pages are entirely responsive by default and look truly awesome on any device?

Such as the features for the Modern team sites and its pages, also new things are being released as we speak where as some are on the roadmap for the near future. I was able to capture 2 roadmap slides from one of the ESPC-sessions (sorry for the bad quality of the first one – I hope it’s just readable enough):

It is clear that Communication sites are here to stay!

Hub sites

People that have been working with SharePoint in the past know that many Information Architecture models contain a lot of site collections, sites and especially a tremendous amounts of sub-sites. Many companies suffered from this way of creating hierarchies on site levels, since users had a hard time to either manage or master the concepts of permission inheritance and assigning unique or breaking permissions.

Since any new Communication or Modern team site is by default a separate site collection, all of these “entities” exist on the same, flat level. There is currently no way to connect these site collections, unless by adding navigation links manually to each site collection and maintain it continuously.

This is where Hub sites provide you with a solution. This soon to be released new type of site will give your (selected group of) users the option to make a Hub site from an existing Communication or Modern team site. This will be the ‘landing site’ which will become an entrance to other, linked Communication or Modern team sites.

Even when the organisation structure changes, Hub sites cover this entirely through simply changing relations between sites and their respective Hub site. #awesomeness

Each of the existing Communication or Modern team sites is going to have the ability to be linked with any existing Hub site. Keep in mind that they can only be linked to maximum 1 Hub site, not multiple.

Next to a top navigation that will be pushed through to linked Team or Communication sites, also a specific theme will be inherited by these linked sites. This causes to be able to navigate fairly easy through multiple site collections which otherwise are not linked at all.

Although they are not released yet, it seems that Hub sites are going to have a great impact on the existing information architecture models of many corporate environments.

Summary

Wrapping up this blog post, I want to mention that in my upcoming blogpost I will be writing about what I’ve learned at #ESPC17 regarding Flow, Teams & Stream and a deep dive into the currently available (in First Release) and to be announced modern web parts.

Please stay tuned!

Pieter

The tool can be used by all O365 users, you do not need to be a global administrator to run the tool. Instead you only need read access to the source data and write access on the destination.

The tool is able to migrate smaller as well as large data batches and execute them in bulk.

Below you can find some more info on the Preview version of the new SharePoint Migration Tool from Microsoft.

The preview version can be downloaded on the following location.

Requirements

Before you begin, check the requirements prescribed by Microsoft.

Following table gives a short overview what happens with the permissions you had allocated to your source data

Using the SharePoint Migration Tool

When opening the SharePoint Migration tool, you will see the following screen.

When you first launch the SharePoint Migration tool, you will be prompted for your Office 365 username and password. The Office 365 credentials you provide will be where the files will be migrated.

After you successfully signed in the tool is asking you where you source data is located:

Before starting the tool, note down where your data is located and where you want to migrate those files.

As you can see above you will need to select the source location and enter the URL for the SharePoint Online site or OneDrive for Business site. Keep in mind you can only select data out of SharePoint 2013 sites or from a local file share or network path.

• SharePoint on-premises:
  If you select the SharePoint on-premises option, you will be asked to enter the name of the SharePoint Server site where your files are located and prompted for your credentials for that site. You will indicate what document library you wish to migrate.

• File Share:
  If you select the File share option, you will be asked to enter the location of the file share, the URL of the SharePoint Online site and document library where they will be moved.

For this demo purpose we will select the File Share option, procedure for the SharePoint option will be identical.

In the next popup screen select the folder or documents (Source) you want to migrate.

When clicking next, you will be able to fill in the destination URL. When filled in the requested detail just click on “Add”

In the next screen you will see the configuration you’ve made for source and destination. Within this screen you have the possibility to add more tasks or to export the tasks to CSV, which can be used later in a bulk migration process.

After you click Migrate, the progress of your migration jobs will be displayed. As they complete, you can view either detailed or summary reports of an individual job or view a single summary report that includes all migration jobs submitted during this session.

Migration report can be downloaded as well to check if the migration is executed correctly.

All folders, subfolders & files were migrated correctly into the SharePoint Online site.

Summary

First impression, The SharePoint Migration Tool lets you migrate your files from SharePoint on-premises document libraries or your on-premises file shares and easily move them to either SharePoint or OneDrive in Office 365.

The SharePoint Migration tool is an excellent tool for simple 1-to-1 data migrations. However, when there are more complex data migration requirements, 3th party tooling such as provided by AvePoint or ShareGate is still the best answer to successfully migrate content.

The following list illustrates the more complex needs:

• Migration of custom permissions
• Migration of 3th party workflows
• Migration of user alerts
• Mapping of site templates, permission levels, users & groups
• Migrating Managed Metadata
• Export from SharePoint to Csv
• Bulk Metadata edit
• Migrating Farm Architecture or Content DB’s
• Migrate sites to different templates or levels
• Version cleanup

Furthermore the new SharePoint Migration Tool currently only supports SharePoint 2013 on-premises & fileshares as a content source.

Ruben Plehiers

Business Innovation Consultant @ Spikes

As more businesses require their web platforms to provide “responsive web design”, it remains a challenge to implement a fully responsive solution with SharePoint Online.

Responsive web design is an approach to web design allowing desktop webpages to be viewed in response to the size of the screen or web browser, so that the user experiences the same level of usability, design and performance regardless of the browser he’s viewing the application with.

Most implementations of responsiveness are built on top of a framework, the most widely used being Bootstrap, an open source framework developed by Twitter.

SharePoint, in particular its web part technology, has always made use of web formatting that is difficult to adapt in a responsive environment.

Additionally, the Online version of SharePoint limits the options for customizations, as Microsoft recommends not to modify its master pages to avoid potential breaking changes during platform updates.

Until recently the SharePoint Online developer had only the option to implement hacks and workarounds through script injection and custom stylesheets to achieve some level of responsiveness.

Over the past months Microsoft has introduced new features in SharePoint Online that should enable a fully responsive experience in the near future.

The SharePoint Framework

Microsoft recently announced the “General Availability” release of the SharePoint Framework (SPFX), meaning that customers can start to make use of it in production environments.
SPFX allows fully customized client side apps, they consist of a package file and a set of client side components that can be deployed on any Office 365 tenant and a Content Delivery Network.

Some of its benefits:

• Is responsive by nature (no iframes)
• Performs well and loads fast in combination with a Content Delivery Network
• Provides easy deployment
• Is compatible with any client framework of choice (React, Knockout, Angular, …)

The modern experience

The SPFX framework is also used on the Office 365 tenants as building platform for the “modern experience”. One of the main features of this modern experience, next to an improved user interface, is responsiveness.

The modern experience has gradually been introduced next to the classic experience, yet Microsoft doesn’t plan to remove the classic experience for now, as many applications have customized their interfaces based on the classic experience.

But as new applications are being built for SharePoint Online, SPFX and the modern experience are now an option to take into consideration.

The current parts of the modern experience are:

• Modern team sites
• Modern list and library experiences
• Modern site pages

Some of their features:

• Provide a simplified user interface
• Sit next to the classic experience
• Fully responsive (menus, navigations, …)
• Enabled by default, but can be disabled

A page created with the modern experience has nearly no html code, only scripts that load all content dynamically.

There are however currently numerous limitations in the modern experience, in particular in modern Team sites:

• No custom master page
• No custom page layouts
• No publishing features (eg. editing controls)
• No custom actions
• No templating
• No property bags (site properties)
• No SharePoint Designer access
• No sandboxed solutions
• Limited set of standard webparts

Also it has no Ribbon or controls to edit its metadata.

For a fully responsive SharePoint Online environment, the developer can combine a Modern site experience with the SharePoint Framework, but this solution still has numerous issues due to the modern Team site limitations.

Another option is to create a classic Team site and to create all its content with the modern experience building parts (modern page, lists, …). However, this will not prevent all the limitations set by the modern experience, eg. when you change the look of your team site, this look won’t be applied on modern site pages, or enabling the publishing feature won’t enable this on modern site pages. The same applies to team site provisioning engines that are not able to apply all features to a modern team site.

The current set of standard webparts in the modern experience:

• Text
• Image
• Document
• Link
• Embedded code
• Highlights
• Bing map
• Image gallery
• News list & headlines
• Video
• Power BI
• Quick chart
• Quicklinks
• Site activity
• Yammer

The list of webparts can be expanded with custom webparts based on the SPFX platform.

There are also galleries of open source SPFX webparts that are released, with custom solutions like list, search , charts, graph webparts, … but some of these were developed with preview, non-GA versions of SPFX and will not work with the GA release of SPFX, so you may have to wait for an update before using them in a production environment.
Also these webparts don’t come with the support of Microsoft, and are msotly released as demo solutions by the community.

As the platform is now ready for production we expect more stable and enterprise grade solutions being made available by third party developers.

However, the platform will still need some important improvements before it can be used as a responsive replacement for customized publishing sites or teamsites, notably

• Custom layouts
• Editing controls for page metadata
• “out of the box” templatable list & search webparts

Update: list & libary webparts are being released – https://techcommunity.microsoft.com/t5/SharePoint-Blog/Introducing-SharePoint-modern-list-library-web-parts/ba-p/64581

Conclusion

The modern experience currently offers some responsive features in the SharePoint environment. Many customizations are not available yet, apart from the possibility to create custom responsive webparts with SPFX.

For quick and ad hoc team environments this is sufficient, like the modern Teamsites that are created with Office Groups.

For larger intranet portal projects, which need templating, branding, easy editing of page metadata and interface customizations, the platform still lacks important features to allow a fully customized responsive environment.

Links

Responsive web design

https://en.wikipedia.org/wiki/Responsive_web_design

The SharePoint Framework overview

https://dev.office.com/sharepoint/docs/spfx/sharepoint-framework-overview

Modern experiences in SharePoint Online

https://msdn.microsoft.com/en-us/pnp_articles/modern-experience-customizations

https://msdn.microsoft.com/en-us/pnp_articles/modern-experience-customizations-customize-sites

SPFX webparts gallery

https://github.com/SharePoint/sp-dev-fx-webparts

Your organization has invested in Office 365. Great! Because it can have a significant positive impact on the organization and its employees with the main drivers often being benefits like increased productivity, flexibility, and collaboration. However, in order to realize these benefits, users must adopt the new technology. One of the first things your organization is looking for after having invested in O365 is therefore probably some understanding of how users are using the technology. This allows the organization to efficiently monitor its service, identify issues, plan support and training and report back on the investment to its management.

In this blogpost, a few methods of finding adoption and engagement information that are available out of the box are explained.

O365: Report center

It has been a few months that Microsoft came up with a new reporting portal, which provides you valuable insights into how the O365 services are being used. Do you want to have a general overview of the usage of different tools in the O365 stack? I suggest you take a look at the report centre. You’ll find specific reports that dig deeper into the use of individual applications, including reports for Exchange, Yammer, Skype for Business, OneDrive for Business and SharePoint.

In terms of general adoption, reports show how many users have been assigned a license and how many actively use the product. This is a key indicator for adoption and allows you to identify the need for additional end user training and communication. For each tool, you can assess whether active use should be further encouraged.

If you want to have a deeper understanding of how a specific tool is actively used, you can consult additional reports. Moreover, details at the user level are offered.

As regards communication, you can find details about the use of Exchange, Skype for Business and Yammer.

• The Exchange reports show how many users have sent, received or read emails and gives insight into the amount of storage that is used.
• The Skype for Business reports provide a consolidated view of Skype activity as well as with details about how many users leverage Skype to communicate with others through instant messaging and how many connect with others by participating or organizing video conferences.
• The Yammer reports provide helpful information about how your organization adopts Yammer as a form or communication including how many users post messages and how many consume content by liking or reading a message.

For each of these communication tools, you can also check through which devices the tool is accessed. If you notice the mobile application is not commonly used for example, additional training regarding this matter can be essential.

Concerning collaboration, reports provide information about how users are using OneDrive for Business and SharePoint for collaboration, both internal and external.

• OneDrive for Business reports show how users are using OneDrive to collaborate with others. Information is provided about how many users use OneDrive to share files and how many use it mostly for file storage.
• SharePoint reports show how SharePoint sites are being used to store and collaborate on files. Information is provided about when sites were last active, how many files are stored and how many files are viewed or edited on a specific site.

Auditing reports

The audit feature allows you to track which users have taken what actions on sites, content types, lists, libraries, list items, and library files of site collections. Although this might provide useful information for business requirements such as regulatory compliance and records management, the data might be too detailed for collecting adoption and engagement information. It can however provide you with a great deal of insight into the activities that are taking place withing your O365 environment.

SharePoint: Popularity trends and most popular items

If you want more insight into a specific site collection, site, libray, list or even an individual item in a library or list, you can check popularity trends or most popular items. This might be useful if you are sharing internal news through SharePoint and want to know how many users are actually reading the news articles for example. Additional training or communication might be necessary.

Popularity Trends shows usage event statistics for a site collection, a site, or an individual item in a library or list. A specific report shows historical usage information about the specific object, such as the number of views and unique users. Such a report can be used to identify usage trends and to determine times of high and low activity.

To see popularity trends for a site collection or site, go to site settings > site administration > popularity trends > usage report.

To see popularity trends for a specific item, go the the list or library where the item is stored, and click on “popularity trends” under the “files” tab.

Most Popular Items shows usage event statistics for all items in a library or list. Go to the library or list, click on “most popular items” under the tab “library” or “list”.

You will see a page where you can see how users have interacted with the content, for example which item has been viewed the most.

Good luck!

 Active Directory Federation Services (ADFS) is an identity provider for Windows. It provides a Security Token Service (STS) that creates and issues SAML tokens to authenticated users to a wide variety of applications.

Example: Single Sign On for Office 365 and other cloud based SaaS applications.

image source: https://blogs.office.com/2014/05/13/choosing-a-sign-in-model-for-office-365/

This article describes the preferred upgrade method from an ADFS 3.0 Farm to an ADFS 2016 Farm.

What is new?

ADFS 2016 has a number of new and improved features.

Security and Identity are hot topics these days. Companies are required to continuously improve the level of access security. New options for eliminating passwords and therefore provide a more secure authentication method a one of the key benefits in ADFS 2016.

• New Azure Multi Factor Authentication (MFA) adapter for AD FS. => authenticator app is available for all mobile platforms.
  Azure MFA allows the user to use an Azure MFA code from the “Azure Authenticator app” for authentication. ADFS 2016 Azure MFA stores the information directly in Azure AD. The implementation has been simplified because the installation of an on-premise MFA server is no longer needed.
• Hybrid conditional access and device policies.
  AD FS 2016 conditional access policies can be used in combination with Azure AD. This hybrid setup uses an on-premise component to give you the capability to enforce the AD FS policies to your cloud enrolled devices. The Azure AD Connect service needs to be configured with the device write back option enabled.
• ADFS Support for Windows Hello For Work. ( =>! Requires Azure AD)
  Windows Hello, previously called Microsoft Passport for work, is a new feature, introduced with Windows 10 that has the ability to replace password authentication with a number of stronger authentication methods; like gestures, Pin code or face recognition.

Some other new features in ADFS include:

• The introduction of Access Control Policy Templates.
• Customized login pages for individual applications make it possible to provide a better corporate branding to end users.
• ADFS 2016 has the ability to send password expiration claims to applications. Example: Office 365 applications can now notify the user when their passwords are about to expire.

Additionally, the upgrade scenario from ADFS 3.0 to ADFS 2016 has been greatly improved, allowing you to add a new ADFS 2016 server to an existing ADFS 3.0 Farm. This eliminates the requirement of completely rebuilding your ADFS Farm.

Upgrade Scenario

We are starting from a Windows 2012R2 domain with two ADFS 3.0 servers and two WAP Servers. The general idea is to upgrade the ADFS 3.0  farm to Windows Server 2016 and ADFS 2016 FBL (Farm Behavior Level). It is the assumption in this scenario that the required certificates, used for ADFS, are already imported on the servers. Additionally network load balancing has also been enabled and configured in this setup.

Basic overview of the setup:

Step 1: Installation of the new ADFS 2016 Server

Deploy a new Windows Server 2016 Server in your environment. It’s recommended that the server will be dedicated to handle the ADFS Role only.

Once the new server is up and running, navigate to the Server Manager.

In the Server Manager, click on manage > Add Roles and Features

Check the checkbox next to Active Directory Federation Services and click on Next and complete the additional installation steps.

Step 2: Configuration of the new ADFS 2016 Server

In the server manager click on the yellow exclamation point and click on “Configure the federation services on this server”.

Click on “Add a federation server to a federation server farm” and click on next.

Make sure you run the configuration with an account that has global ADDS domain permissions and click next.

Specify the old 2012R2 server, in this case this is server “ADFS01V.

Select your certificate (please note the assumption in this procedure is that the certificate is already imported on the server).

Specify the ADFS service account that you use on the other ADFS servers.

Click configure to complete the configuration.

Step 3: Migrate ADFS 3.0 roles to the New Server

Set the new ADFS 2016 server as primary ADFS server:

Set-AdfsSyncProperties -Role ‘PrimaryComputer’

On the old primary ADFS 3.0 server run the following command:

Set-AdfsSyncProperties -PrimaryComputerName ‘newprimarycomputername’ -Role ‘SecondaryComputer’

On the other secondary ADFS 3.0 servers run the following command:

Set-AdfsSyncProperties -PrimaryComputerName ‘newprimarycomputername’

Check the FBL Level:

Get-AdfsFarmInformation | fl *

Step 4: What to do with the existing WAP servers?

Two options:

1. Keep the existing WAP (Windows Server 2012R2) servers in place and use them in combination with the new ADFS 2016 Server(s). Because you are reusing the existing configuration there will be a minimum impact on your users experience and your IT environment.
2. Install new Windows 2016 servers in your DMZ and deploy the Web Application Proxy service. This is a more complex approached that might require downtime depending on your environment.

Step 5: Upgrade to ADFS 2016 Farm Behavior Level

! Until this point the new ADFS 2016 has been running in 2012R2 ADFS 3.0 FBL mode. To enable the 2016 features of ADFS, you will need to raise the FBL of your new ADFS environment. Before continuing please make sure you decommission your old ADFS 3.0 servers. You can simply uninstall the ADFS role from these servers.

! Important: It is not supported to utilize a Windows Server 2016 FBL without first using the Windows Server 2016 Active Directory schema. You will need to run ADPrep using the Windows Server 2016 installation media on a Windows Server 2012R2 domain controller.

To raise the FBL to ADFS 2016 of your ADFS farm, run the following command from an elevated PowerShell prompt

Invoke-AdfsFarmBehaviorLevelRaise

Step 6: Testing and validating upgrade

Get-AdfsProperties | Select CurrentFarmBehavior

Flow will let you automate business processes based on the connectors for services that are available. You can start building a flow from scratch, or you can start by using one of the many predefined template. For creating one yourself, all you need is a modern browser. At this moment, there are around 100 services that can be used by Flow. A list of all services can be found at the following location: https://flow.microsoft.com/en-us/services.

PowerApps on the other hand is an enterprise service for building business apps which can be created without writing code and have the possibility to be connected with different data sources, connectors and gateways. These apps can be shared throughout the company and can be used on different environments and devices. You can access the PowerApps via a modern browser, or via the apps for Windows 10, IOS or Android. The apps you created will be visible in an overview on your own PowerApp page and in the SharePoint list as a view. A PowerApp can be created in the PowerApps studio for web or Windows. This means you have the possibility to develop your business apps online, on the web or dedicated on your Windows machine.

Managing PowerApps and Flow however still has its flaws. To start off, every user who has access to PowerApps can create an app. As an administrator, it’s not possible to check how many apps currently are developed and used. However, there is an admin center available (https://admin.powerapps.com and https://admin.flow.microsoft.com) with some other administration tools. Unfortunately, the only parts you can manage (at this time) are environments and data policies which we will dive in briefly.

Environments

Environments are used as a space to store, manage and share the apps, flows and business data from your organization. You may choose to create separate environments for development, test and production, or you can choose to just create one environment for everything. If you choose to splits up your environments, this will impact the development of your app because the resources which are put in an environment are only accessible to the other entities within the resources and are bound to the geographic location of the selected datacentre. So, if you create an app in the environments ‘test’, it will be able to access the data sources from the test environment, but not from the production environment. Within the environment there are two roles defined, an Environment Admin and an Environment Maker. Global administrators can also manage all environments that have been created in their tenant and set tenant-wide policies from the PowerApps admin center.

Data Loss Prevention (DLP)

Data loss prevention policies are used to protect the business data of a company. In short
it will guarantee that an app which has no rights to share the data, will not be able to so with the company data within their PowerApps of Flows. When adding a DLP, a service can be added to the list which will block exploiting the data from the selected service. A list of all connections possible for PowerApps can be found here: https://powerapps.microsoft.com/en-us/tutorials/connections-list. These limitations can be very useful as the users is probably working with live data.

Conclusion

As stated, these settings are applicable on both Microsoft PowerApps and Flow. So basically, there is no real way of managing and governing the flows and apps created by users except for the possibility to restrict it. This is no surprise because it’s Microsoft’s vision on these tools. Microsoft has built these tools for power users, and so the flows and apps a user creates are bound to the user account. A drawback of this, is that if a user creates and shares an app or flow, but the account of that user gets disabled or deleted in the future, the shared apps and flows will be lost, regardless if other users still use the shared apps and flows. These are things to keep in mind if you decide to use these tools. Be aware that these products are still in preview! Let’s hope Microsoft will expand the managing features in the future to make governance easier, so these tools can be used in a real production environment.

Over the last few years I’ve worked on projects where we enable customers towards Office 365. Mail migration, collaboration (SharePoint) skype for business, yammer etc..

Most of the times we have difficult discussions about the choice that could be make about changing the userprincipalname and if it’s really required to change it.

Next to it, it looks like is has become a complex situation convincing our customers to choose for the one single identity. And understand the importance of it. Mostly struggling thought an assessment phase we give the understand to our customers that we should take enough time for the importancy of “identity”. Certainly in this time were security is one of the most important priorities for organizations to improve. And we don’t want to mix-up accounts and make new account for each platform where we like a user could connect to.

In this blog I would like you to understand from an end-user and administrator perspective why to choose for a single identity, cross-premises. And how we could start from this perspective to guarantee that it will become easier for you and your end-users.
In parallel i’ve mixed it with the discussion of changing a part of your identity which is an uniform userlogonname, the userprincipalname.

Hybrid identity – is it a central identity?

“The core of a Microsoft-based centralized identity is Active Directory.” As for a lot of customers we see they have a well implement Active Directory in their organization on a mature and strict way. They use their identity for signing in on their devices, use their identity for their CRM solution, HR platforms, etc…

Hybrid identity – cross premises.

Now, after we have our ‘central identity’ platform ADDS on-premise. We could extend this towards another premise. Therefore we use Azure AD to synchronize the on-premise identity towards Azure Active Directory.

“What is a UserPrincipalname, should it change, and if we change it, will we impact all our users?”

It’s one of the most raised questions, and it could be a complex one. An userprincipalname is the logon name for the user to authenticate toward Active Directory. In an O365 deployment it’s the unique identifier we are using through the environment. As for exchange on-premise and in the cloud.

Administrators are aware where to find it, but let me show you what I meant:

Blue = Userprincipalname = Userlogon (max lenght in characters 64)
Orange Samaccount = Pre-Windows 2000 Logon (max lenght in characters 20)

Like it or not, working towards an identity synchronization directory requires some effort for administrators to provide the best experience for your end-users. In a lot of companies we see a difference in configuration when we are talking about UserPrincipalName (UPN) and the synchronization of it. Some companies are confident that they should not change their UPN and keep them identical to the samaccount. Some choose to change the UPN to the mail address.

For better user experience. It’s well recommended to change the UPN and match it with the primary mailaddress. Make it synchronized to have the same identical name in the on-premise environment as in the cloud.

Make it easier for your users:

When logging in in Onedrive, Onenote and almost all Microsoft services you will be asked to fill-in your mail address. But they mean your UPN.

Skype for Business:

When using skype for business, your default ‘login’ will be your SIP Address. So it is unclear for a user which login they should enter. You could update your SIP addresses to have the same identifier as your mail/upn. Or you could choose for a different address and let your business contacts know that you cannot be reached on your mail address but on your dedicated Skype For Business address. So splitting up your mail address and skype address could be chosen.

What about federation:

You could implement Active Directory Federation Services (ADFS) to have Single Sign-on (SSO) features to help your user logging-in in O365 services. Keep in mind that when they are at home they still need to go through the ADFS and authenticate based on Windows Authentication or Forms Authentication.

Bring it all together:

For an end-user perspective, it’ best to explain your employees that since you are moving more and more services to Office 365 to start working with their UserPrincipalname which is their mail address.

Keep it simple: Let your employees login with 1 identifier which is their mail skype and every other Office 365 services address.

And If it requires a change, let’s do it right away. Communicate the change to all your employees. So you could start as soon as possible with their one and only, simple, single identity.

We’ll cover these topics:

• Sharing
• Sync
• Storage
• Device access
• Compliance

Sharing

In the sharing section, you control access for internal and external users. Both can be managed separately and sharing settings can be set to include or exclude anonymous links or external users.

A welcome change is to limit the domains that are accepted or blocked for sharing access.

Sync

The admin page allows admins to control what machines can sync company data or to block syncing of specific file types.

Multiple domains can be added as an Allowed domain to sync data. An admin can, together with the option to block syncing of specific file types create very simple rules with a high return on data management.

Microsoft also provides a link that provides solutions to the most common OneDrive problems.

Storage

Next on the options list: storage. By default, users get the full amount of storage. Since here are plans with 5Tb, this can be a bad idea.

The managers will receive a notice when a deleted user’s files will be deleted, the admin page lets you set the period after which data will be deleted.

Device access

Device access options allow a setup of a granular access to protect the user his data. IP whitelisting and modern authentication can be enforced. But the creation of a mobile application management policy is a welcome feature. Note: Intune policies will take precedence for the selected users and will not be enforced on personal accounts.

You even can manage the offline behaviour of the client.

Compliance

If the organisation has legal, regulatory or technical standards or if there is the need to identify or and protect sensitive information, this can be done in the Security and Compliance section.

Next to auditing, DLP policies can be created. Data loss prevention (DLP) policies help to identify and protect your organisation’s sensitive information. For example, you can set up policies to help make sure the information in email and docs isn’t shared with the wrong people.

In the alert section, a lot of OneDrive actions are added so notifications can be generated and sent out.

Final notes

Microsoft added some very nice features what makes OneDrive more business friendly by enabling admins to control the way OneDrive and the company data behave. Users were able to sync the data to almost any device and it would stay accessible even if the account is removed. I surely hope that this is only the first step towards central OneDrive management.