Category Archives: M365AutoLink

M365AutoLink, Microsoft Teams, Office 365, OneDrive for Business, Powershell, Sharepoint Online

M365AutoLink v1.3

Leave a comment

Today brings quite the update to M365AutoLink! Big improvements to central management and performance! Read below for all changes.

Or just get it here: https://github.com/jflieben/M365AutoLink

Security & authentication

  • PKCE + state added to the browser authorization-code flow. Any callback whose state does not match is ignored, so another local process can no longer inject an authorization code.
  • v2 (v2.0) Entra endpoints are now used for both the authorization and token requests (scope= instead of the legacy resource=), aligning with the OAuth 2.1 public-client baseline.
  • Loopback listener hardened: switched from a raw TcpListener on a fixed port to System.Net.HttpListener on an ephemeral port (fixes collisions on multi-session RDS/AVD hosts and races between instances). All reflected error text is HTML-encoded, and a small branded landing page is shown after sign-in.
  • TLS 1.2/1.3 is enforced at startup on Windows PowerShell 5.1.
  • Uninstall now deletes the refresh-token cache and log (RefreshToken.xml is a usable credential and must never survive an uninstall).
  • Consent/sign-in failures no longer call Exit from deep in the request path (which silently killed the tray). They surface as an error balloon with the admin-consent URL and keep the tray alive for a retry.

Reliability

  • Access-token caching fixed: a valid cached access token is now reused instead of performing a full refresh-token exchange (+ DPAPI encrypt + disk write) on every API call. Token lifetime comes from expires_in with a 5-minute renewal margin; the refresh token is written to disk only when Entra rotates it.
  • Deletion circuit breaker: the delete phase is skipped (with a warning + balloon) when SharePoint Search returns incomplete results or the desired set shrank by more than $DeletionSafetyRatio. A tombstone model requires a target to be absent on $DeletionTombstoneRuns consecutive runs before deletion. $ForceReconcile overrides both.
  • Single-instance guard: a session mutex prevents two tray icons / token-rotation races / log contention. A second launch signals the running instance to run and exits.
  • Metadata lookup no longer aborts the whole run on one transient error; failed items are skipped with a warning.
  • Unified retry pipeline: Invoke-GraphRaw (config load/save) now retries transient 429/5xx/network errors, with correct Retry-After handling on both PowerShell 5.1 and 7.
  • Logging is written directly to lastRun.log (no longer dependent on Start-Transcript) and rotated (run-<timestamp>.log, keeping $LogHistoryCount).
  • Pre-flight checks warn (in one balloon) when OneDrive is not set up for a work account or the identity provider is unreachable.

Performance

  • Existing-shortcut metadata is fetched in a single RenderListDataAsStream call (with an automatic per-item fallback) instead of one call per shortcut.
  • The fixed Start-Sleep -Milliseconds 500 after every create/rename/delete was removed; throttling is handled by the shared retry/back-off.

UX

  • High-DPI: the process declares per-monitor-v2 DPI awareness and the floating progress bar scales with the display, so the UI is crisp at 125–200% scaling.
  • Manage shortcuts dialog: text filter, click-to-sort columns, Exclude-all/Include-all, and the window is resizable and remembers its size.
  • Periodic auto-refresh ($AutoRefreshHours, default off) re-runs on an interval while resident in the tray and shortly after the device resumes from sleep.
  • First-run onboarding balloon explains where the shortcuts are and points at Manage shortcuts.
  • Reduced the logon console flash on Windows 11 by launching through conhost.exe --headless.

Compatibility & correctness

  • PowerShell 7: large SharePoint JSON payloads use ConvertFrom-Json -AsHashtable instead of the .NET-Framework-only JavaScriptSerializer; Add-Type -AssemblyName replaces the deprecated LoadWithPartialName.
  • Wildcard exclusion/inclusion now uses PowerShell -like (correct anchor semantics). Note: exclusions tighten slightly — a trailing * is required for prefix matches (e.g. */sites/HR*).
  • Window-drag handler resolves the form at event time (dragging borderless dialogs works reliably).
  • Dead-code sweep (unused launch-mode set, per-page blocking GC, stale unique-name state).

Automation, Azure Virtual Desktop, M365AutoLink, OneDrive for Business, Powershell, Sharepoint Online

M365AutoLink unattended

1 Comment

Doing logon scripts is easy for some, less easy for others, and in general not great in certain types of environments.

And this led to some questions if I could also make a version of M365AutoLink that can run centrally. There was a hurdle to overcome: how do we know what libraries a user has access to?

M365Permissions already has the answer, so a quick copy paste from the code there and voila, we now have a centrally runnable version of M365AutoLink!

It can run either as managed identity, or cert-based service principal. I recommend running it as a runbook, and don’t run it on tenants with thousands of users or commercially….for commercial use click here 🙂

For full documentation and code: https://github.com/jflieben/M365AutoLink

M365AutoLink, Microsoft Teams, OneDrive for Business, Powershell, Sharepoint Online

M365AutoLink

2 Comments

We often still have legacy apps around. First advice is always; get rid of them 🙂

But sometimes, that’s not the option the customer wants to pay for, so alternatives need to be researched. Commercial tools like IAMCloud Drive Mapper work really well in exposing Teams/Sharepoint as driveletters on endpoints (for a price).

But free solutions are limited to automapping using GPO’s or letting users sync each team they need access to manually. This often causes issues on multiple fronts that I’m sure you’ve already experienced if you’re reading this.

So here’s an alternative to try! M365AutoLink is a PowerShell script you can execute on the user’s device. It’ll try to use SSO and then:

  1. check all sites the user has access to (including Teams)
  2. filter sites you do and don’t want
  3. create a folder in their onedrive if it doesn’t exist yet (you can decide how to name it)
  4. add all these sites as shortcuts in this folder
  5. remove any shortcuts the user no longer has access to

And since Onedrive syncs these links, any legacy apps on the user’s device can now also directly access Teams/Sharepoint, without syncing down the entire library or using drive mappings!

Documentation and download

https://github.com/jflieben/M365AutoLink