Automation, EntraID, Microsoft Teams, Sharepoint Online

New tools added!

1 Comment

Added a bunch of new tools to the LCTools subsite, mostly old PowerShell tools I used for customers in the past that were still popular.

Duplicate Device detection and sunsetting: https://lieben.nu/tools/DupedDevices

Finding and cleaning up stale SPO sites:

https://lieben.nu/tools/SPOTrim

Finding and managing inactive guest users:

https://lieben.nu/tools/InactiveGuests

Finding and cleaning up inactive devices:

https://lieben.nu/tools/InactiveDevices

Running a Maester scan from your browser without PowerShell:

https://lieben.nu/tools/SimpleMaester

Running a Zero Trust Assessment from your browser w/o PowerShell:

https://lieben.nu/tools/SimpleZTA

Exchange Online

Microsoft.Exchange.Data.Storage.MailboxInfoStaleException

1 Comment

Error executing request. Can’t connect to the mailbox of user Mailbox database guid: <some guid> because the ExchangePrincipal object contains outdated information. The mailbox may have been moved recently. Microsoft.Exchange.Data.Storage.MailboxInfoStaleException

if you’re getting the above, on april 30th 2026 Microsoft began enforcing that the X-AnchorMailbox header contains the actual mailbox identity (ID) (and @tenantId) instead of the generic SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c} value.

This, however, is currently only enforced for specific in-mailbox commands, e.g. Get-ExoMailboxFolderPermission

If you’re using Michev’s admin api method, you may run into this 🙂

Azure DevOps

Enumerating organizations and projects in Azure DevOps using a Service Principal

1 Comment

Azure DevOp’s API’s still have a slight preference for delegated api calls (calls from users). For M365permissions scans run through a managed identity, which as a type of service principal cannot normally enumerate the organizations in a tenant. Not knowing the orgs, you also can’t enumerate projects etc.

I tried a year ago and failed. Coming back to it now in some spare time, after struggling a lot with Fiddler & PowerShell, I finally figured out how to get orgs without delegated authentication.

It was actually quite simple, as always…just a single GET to:

https://vsaex.dev.azure.com/_apis/EnterpriseCatalog/Organizations?tenantId=YOURTENANTIDHERE&api-version=7.1-preview.1

This returns a csv type formatted string with all orgs your SPN has permissions to! Isn’t that cool?

Oh and don’t forget, the token you get should be for the audience 499b84ac-1321-427f-aa17-267ca6975798

Microsoft 365, Azure, Automation & Code