We happened to watch “Good Fortune” this weekend. It's a blast of a movie! I had so much fun watching it. I didn’t realise it was written and directed by Aziz Ansari (his movie debut). If you like his stuff you’ll definitely enjoy this one! Very satirical and funny. The movie also ties with a lot of the books and podcasts I consume nowadays.

Continuing with SuccessFactors on Android, one of the things the app does upon launch is to ask whether you want to use a password or fingerprint. If I select "fingerprint", it says there's no fingerprint to be found. And if I select "password" I can setup a new password and use that each time I open the app. That seemed a bit inconvenient, and I was curious why it wasn't finding the fingerprint - especially coz my phone had fingerprint and face unlock setup.

We wanted to push the Android and iOS apps of SAP SuccessFactors. iOS is easy. Push the app out to a group. Also push out an app configuration so the app knows what to do when a user clicks on it. Easy peasy. This article has a list of the keys you need to push out. And you can do so via an XML file like so:

Sweet, Hammerspoon can run macOS shortcuts! So awesome. 🥳 In a similar vein to my tinkering with Hue lights... I have a BenQ ScreenBar Halo on my monitor which I'd like to turn off when I logoff or my Mac goes to sleep. The latest version of the Halo has some sensors that can detect when you are around, but I don't have that nor have any plans of buying that, so I wondered what else I can do.

"Blood in the Machine" - the book - by Brian Merchant, is crazy! I am only some 100 pages in to it so far, but it is so shocking and eye opening. I never knew this was what the beginnings of the Industrial Revolution was like. I never know this was what the Luddite movement was about. And worse, as Mark Twain said (a quote I found in this book) "History never repeats itself, but it does often rhyme" - so true!

I have an automation that goes through the Graph audit logs API output for any Conditional Access policy changes. I noticed that the output for these had a few entries that looked like "excludeGuestsOrExternalUsers":{"guestOrExternalUserTypes":63, ...} That made no sense. The valid values for guestOrExternalUserTypes should be one or more of of none, internalGuest, b2bCollaborationGuest, b2bCollaborationMember, b2bDirectConnectUser…

Just adding a link to this Microsoft blog post I previously linked to, and especially the video in it. Wanted to capture two screenshots from there. This is how enrollment works for Android phones And this is how it works for Android AOSP This puts into pictures what I saw in the logs in the previous posts. ☺️ The Company Portal app is no more.

Continuing from my previous post (which is a continuation to another post), during my last enrolment the phone OS upgraded from Android to Android AOSP. This was not unexpected because Microsoft is in the process of moving Teams phones from Android to Android AOSP. Details can be found in this blog post and my phone model's latest Android firmware is on the list of supported devices.

Continuing from my previous post, I upgraded the Yealink MP56 phone to the next available firmware. Firmware 122.15.0.107 This firmware is from December 2022. Here is what the admin page shows post-upgrade: Firmware Version: 122.15.0.107 Hardware Version: 122.1.0.0.0.0.0 Company Portal Version: 5.0.5484.0 Teams Version: 1449/1.0.94.2022110803 Admin Agent Version: 1.0.0.202209060820.product This is new, wasn't present originally. Things are a bit different now when powering on the device.

I wanted to document the authentication flow for Teams phones. This is by no means comprehensive, but only what I have been able to gather by looking at a Yealink MP56 phone. The device itself is discontinued, but firmware updates are available so it works with Teams. The device I got happened to be on a really old version of the firmware, so I was able to try it across various versions.

Continuing my trilogy (here and here) of Hue API posts... in my previous post I detailed how I set the lights to turn or or off when I login to my Mac. Slight issue with that. When I used to do this via the Hue sensor, it would set the correct scene coz the sensor was set to power on the light with a particular scene.

Barely a few days since my previous post on having fun with the Hue API, and the sensor stopped responding to my API calls. There's no error or anything, the sensor just doesn't get enabled! I run the command as before: APIKEY=$(pass apiKeys/hue) BRIDGE_IP="<ip>" SENSOR_ID="<guid>" echo "${GREEN}✨ Enabling sensor${RESET}" curl --request PUT \ --url \ --header "content-type: application/json" \ --header "hue-application-key: $APIKEY" \ --data '{ "enabled" : true }' \ --insecure…

Encountered a red-herring of an error today. A colleague shared a Power App with another colleague and got the following: The user in question was indeed enabled and licensed. Also, interestingly, the user Id in the error didn't match that in Entra ID (but then I guess it must be the Id of the object in Power Platform itself). Even though my colleague got an error, when he looks at the "Share" pane the user is added there.

Every so often I get a request from one of our IT folks asking if I can add such and such app to our App Protection policies. Thing is, most of the time the app in question isn't one that's supported by Microsoft/ Intune. (See this article for a list of supported apps). Inevitably a follow-up question is whether I can…

Playing with Functions in KQL today. One of the things I wanted to do was troubleshoot the input I am passing to a Function. Couldn't figure out a obvious way to do this, so here's what I did. My objective here is simply to see if I am even passing inputs in correctly! At this point I am very new to KQL functions so we are talking basics here.

I have a Hue sensor on my desk that turns on and off the lights on the desk when I am at it. Since my desk is in our bedroom, and I don't want the sensor to be active during weekends, I wanted an easy way to disable it on weekends and enable it after weekends (or maybe not enable it, I think I'll enable it manually depending on whether I am actually working or not etc).

So... there was an Azure outage today. Related to Azure Front Door. That was my evening gone! As the resident PowerShell person on the incident call, as part of implementing some workarounds I had to add a bunch of IP addresses to a Network Security Group. I was given a text file with a bunch of IP addresses, and my task was to add them all to the NSG as "Deny" for "Inbound" traffic.

I enjoyed "A House of Dynamite" which was released this week on Netflix. Not many people seem to like it though! Yes, the ending was abrupt, but I loved it. To me that made sense, and it was the only possible ending one could have for a movie like this. The movie wasn't about the ending, it was about the ordeal leading towards the ending.

I use Firefox. And I use the multi-account containers extension heavily in that. Very useful at work too when I have multiple test account and want to sign in with these, as I can open these up in separate tabs as opposed to separate windows as one would do with Edge etc. As part of testing some new Conditional Access policies however, wherein we were limiting users to hybrid joined or compliant devices, I noticed that my test accounts stopped working with the "You can't get there from here" message.

I wanted to get a list of users recently removed from an Entra ID group. I can see the removals in the audit logs, but there's easy way to add a column showing removals. Enter KQL. We are sending all audit logs to a Log Analytics workspace, so I queried this info that way. This is a very trivial use of KQL, but I am just putting it here for my own reference later on... 

A colleague reached out regarding an issue. He had created a Team and applied a sensitivity label to it. Unfortunately, this sensitivity label disabled external sharing. He then went ahead and remvoed the label, but he still couldn't add external users (even after waiting for a few days). I took a look at the group and found that sharing to guests is still disabled.

O365 add-ins, also known as M365 Apps or Integrated Apps, are what you can deploy to Outlook etc. via this section of the M365 admin center. As per the docs, you need to be a Global Admin or an Exchange Admin (possibly with Application Admin, depending on certain conditions) to do this. And while that seems to be the case with the portal, it looks like one can do some tasks with only the Application Admin role via PowerShell.

At work I spent some time yesterday working on a side project to setup forwarding from one set of URLs to another. We are migrating a service from our on-prem world to the cloud, and there are tons of URLs pointing that will now get invalidated as a result. In the on-prem world the URLs are of the form

Quick shoutout to "Code Dependent" by Madhumita Murgia. I stumbled upon it at Waterstones the other day and purchased it on a whim. So glad I did as it was a very enjoyable read. I was half expecting (and not looking forward to) it being a book that bashes AI (or goes the other way and gushes over it). Instead, this book was very neutral.

Little things in life... but I killed an AI idea today at work, and I am pleased about that. 😀 A colleague reached out with a requirement he got from someone else. They wanted to create an AI agent that will scrape the Internet for certain types of news and put it into a SharePoint site. I looked at the problem differently and said this doesn't need AI.