Detection users without SharePoint or OneDrive

[poulpreben]

Hi all. We are backing 16,500 users in 65,000 users tenant. About 60% of those are assigned with the Microsoft 365 F1 SKU, that only give them access to Exchange Online. They have no OneDrive or SharePoint, and as a result VBO365 throws thousands of warnings like this every day:

Code: Select all

11-06-2020 21:00:45 :: Processing OneDrive NAME1 completed with warning: OneDrive was not found (ID: $uid, name: NAME1)
11-06-2020 21:00:45 :: Processing site NAME1 () finished with warning: Personal site was not found (ID: $uid, name: NAME1)
11-06-2020 21:00:47 :: Processing OneDrive NAME2 completed with warning: OneDrive was not found (ID: $uid, name: NAME2)
11-06-2020 21:00:47 :: Processing site NAME2 () finished with warning: Personal site was not found (ID: $uid, name: NAME2)

I have tried to wrap my head around how to efficiently remove the warnings.

1. If we create a script that excludes the processing of OneDrive and SharePoint for the particular user, after detecting the warning the first time, that user could lose data if their subscription was ever upgraded.
2. Alternatively we could query the assigned Office 365 subscriptions for each user and split them into F1 or F3 groups. Exclude processing of OneDrive and SharePoint for the F1 groups.
3. Ideally, VBO365 could detect either the subscription or more generic: the existence of the services for the user account. The above warning could be changed to an informational message such as "Processing of $service1, $service2 skipped for user $name (Not found)"

Do you have any suggestions?

[nielsengelen]

2 is probably the best option and adjust it to monitoring for changes so if they do get the other services, you can enable them. The harder thing may be to move them to another "all in one" job so you don't overload the F1/F3 backup jobs.

For 3, it may be something for us to look into.

[poulpreben]

Following up on this, we have now split users into groups based on their subscription. Even with this optimization, we are still seeing about 10,000 daily warnings. Having a full license such as E3 or E5 does not implicitly mean that you have OneDrive or SharePoint provisioned. This seems to happen only when the user starts consuming the resource.

I saw a this scripts on VeeamHub that seem to try to solve this issue: VBO-CleanupBasedonJobWarnings. However, this will simply exclude anything that matches my described problem. Considering #1 in my original post, it does not seem like a good solution.

What is the reason for presenting a non-existent resource as a warning entry in the log? Assuming that the service account/application permissions are configured correctly, I would say that there is absolutely nothing wrong with having an account that does not have all resources provisioned. I would definitely want an error or a warning to be issued if an object within the particular resource cannot be backed up, but if the resource does not exist at all, why would we want that to show up in the session log?

I am happy to provide more information about the layout of the tenant, if that could be helpful in optimizing the processing logic.

[Mike Resseler]

Preben,

There are two sides on the story. We either could change the logic and skip the warning, but then people will complain that they missed important notifications. Whenever you create a user and assign a full license to it, MSFT expects that all is used. We connect against it, but then we run into these warnings (basically we don't find it as it is not provisioned). The other problem is that we cannot distinguish between a non-existent resource or effectively an issue, so it could mean again that we miss important information if something is wrong with an existing resource.

What I can do is request MSFT to give us more information when we catch the problem, so that we know what exactly is the problem, but I fear that will take time on their side. And they need to agree with it of course.

[poulpreben]

Hey Mike. I understand your viewpoint, but I think that we could discuss the premise for that particular warning. The warning in question only appears when the resource does not exist. While I have heard some of the support team's anecdotes about customers demanding restore of data that was never protected, I believe this is a manageable corner case

Analogous to VBR, there is the ability to include all disks when backing up a virtual machine (the default). Using this setting does not result in issued warnings for VM disks 0:1, 0:2, ..., n:n, when those do not exist. VBR will ignore such disks silently.

[Mike Resseler]

Yes, but again, we know it can happen and the same warning appears when something is wrong and the resource DOES exists. And that is another game. No matter what, I will certainly discuss this with MSFT and we can see if there are additional checks that can be performed to figure out if it is an existing resource, or not.

[cs@wilson.edu]

I am facing the exact same issue. I do understand why it appears the way it does, but hopefully a more accurate detection means can be worked out. I would really like to see the final job status come back as "success" instead of "warning" each day, and only really warn me when there is a true problem. *Fingers Crossed*

[JRRW]

You could leverage a Azure/Microsoft 365 dynamic group that adds/removes based on criteria.

Or - given the size of your org - you should be able to adjust your user creation script to automatically 'create' the users OneDrive upon provisioning. I think it's via Request-SPOPersonalSite

[cs@wilson.edu]

I am already using dynamic groups to do most of the work. We are in the process of migrating from on-prem to O365.
At the moment, I have fully synchronized on-prem AD with Azure AD to enable MFA/SSO, but i have not migrated all mailboxes or files yet.
Those without a Mailbox/OneDrive/SharePoint are what is causing the issues.
I am able to successfully back up the files users that i have migrated.
Our backup status results in an overall "failure" every night because of the fact that it sees the other users, but it cannot access the Mailbox, OneDrive and SharePoint, which is correct as they don't exist.
There is also the issue with Deleted Users. Same problem. It is trying to backup non-existant data.
I just need the ability to ignore those non-existant cases and give me a "Success" backup status.

[Mike Resseler]

Hey Alan,

Understood, but we will need to figure out a few things, no promises at this moment I'm afraid

[JRRW]

I am already using dynamic groups to do most of the work. We are in the process of migrating from on-prem to O365.
At the moment, I have fully synchronized on-prem AD with Azure AD to enable MFA/SSO, but i have not migrated all mailboxes or files yet.
Those without a Mailbox/OneDrive/SharePoint are what is causing the issues.
I am able to successfully back up the files users that i have migrated.
Our backup status results in an overall "failure" every night because of the fact that it sees the other users, but it cannot access the Mailbox, OneDrive and SharePoint, which is correct as they don't exist.
There is also the issue with Deleted Users. Same problem. It is trying to backup non-existant data.
I just need the ability to ignore those non-existant cases and give me a "Success" backup status.

So your Dynamic Groups add users even if they're not licensed for SharePoint/OneDrive/Exchange? Or, is it because they haven't logged into them and thus do not have them created? That's where we're using a script as part of our new user setup script to 'manually' (automagically) force creation of the OneDrive for a user created.

I do see the value of your overall request though, that 'onedrive cannot be found' shouldn't cause a failure or be able to not warn on that element.

[Mike Resseler]

Hi All,

Some research has been done from my side, and there might be a possibility for the OneDrive/ SharePoint personal site scenario, but for the mailbox I seem to have more issues. Anyway, it certainly won't be a feature for the upcoming release (soon...) but it is on the discussion table for the next release.

[cs@wilson.edu]

JRRW,

My issue does center around the fact that users have not logged into their OneDrive, and it has not been created.
I did not even know about the existence of the script that will force the creation of their OneDrive.
For others, the PowerShell script is:
Request-SPOPersonalSite -UserEmails [USERNAME]@[DOMAIN].mail.onmicrosoft.com

I have run that against all of our existing users, and have incorporated it as part of our normal onbarding process.
Hopefully that takes care of the issue. Thanks for the suggestion!

[JRRW]

Hope it helps!

Again, I do think it'd be a nice feature to mute those sort of alarms, but we have had cases where we've needed to do that anyways. In example, HR has recently asked if we might work in the ability to have a pre-created set of documents pre-loaded into new employees OneDrive prior to their first day.

I also can't take credit for our own system, oddly enough it was our CIO who dreamed up the idea when he was tasked (as just a developer / main IT guy many many moons ago) with creating a home-brew HR system. He then worked to enhance that package (he called it Operations Manager, which through me off as I confuse it with SCOM and VROPs) over the years, until now we've had a mind bending amount of automation built into it.

It's not that different in premise than Automate101 (once called Citrix CPSM which was spawned from the OG software called Cortex when I first dealt with it in 2010) but in my opinion more focused. It allows HR to fully create a user, provision a 'local' phone number (integrated with our DiD database and provisions correctly on E5 plans), assigns appropriate O365 licensing, security groups based on position they're hired for, etc. For letting people go it does the reverse, removing licenses and properly disabling accounts, changing passwords, even allowing 'scheduling' of terminations to ensure IT is not the bottleneck.

Makes our help desk imaging their machine easier as SCCM uses those security groups to auto-install software that's required, etc. Come to think on it it's probably something we could sell the code for, haha.

Point is though, even on a smaller scale it's super helpful for any company that has decent hire (and fire) to have some form of automation around O365 creation, which people can build things like OneDrive auto creation into.


In Veeam land, it's one reason I hope VBO keeps getting more and more Powershell/API integrations as it's my goal to additionally automate things like moving users data from certain repositories into others (i.e. production into an archive/long term retention for terminations)

[Mike Resseler]

"In Veeam land, it's one reason I hope VBO keeps getting more and more Powershell/API integrations as it's my goal to additionally automate things like moving users data from certain repositories into others (i.e. production into an archive/long term retention for terminations)"

Read that loud and clear

[cs@wilson.edu]

Two things to follow up on:
1. Running the Request-SPOPersonalSite cmdlet does indeed force the creation of the SharePoint/OneDrive.
2. There is a syntax error in the script that I posted:
A. The user email address MUST be wrapped in quotes.
B. If you are a hybrid environment, then the script should be: Request-SPOPersonalSite -UserEmails "[USERNAME]@[DOMAIN].[TLD]" (not [DOMAIN].mail.onmicrosoft.com)
If your syntax is incorrect, there is no warning, error, or other feedback. It just doesn't work. Nothing happens.
If correct, the site is created within seconds.
Thanks again JRRW!

[Elemer.gazda]

Has there been any advancement on this?
We have a customer where certain users DO have a License (Microsoft 365 Basic Standard - for the user I am currently looking at), BUT the "SharePoint (Plan1)" is not enabled/ticked.
It would be good if the log would be Information in this case, as Our monitoring is creating a ticket whenever the job doesn't finish with a "Success".

[Mike Resseler]

We haven't made any progress on this as the discussion was last November and we couldn't make any more changes to the build we were preparing at that point in time. At this moment there is still debate on it, but we certainly haven't forgotten about it.

[Regnor]

I've just ran into this when adding objects via script to a backup job. I wouldn't suppress this warning per default, but perhaps it's possible to add an optional setting in the notifcations or a registry key.
I did also go with option #2 from Preben, which should work as long as the groups are correctly filled and no administrator assigns licenses/features directly.

[pvz]

We haven't made any progress on this as the discussion was last November and we couldn't make any more changes to the build we were preparing at that point in time. At this moment there is still debate on it, but we certainly haven't forgotten about it.

Hello, Mike!

It's been some time, so I thought I might bump this and ask, have you made any progress on this?

[Mike Resseler]

Unfortunately no. No additional progress on it. Long story short. There is not only this specific "warning" but there are others that we see on a regular basis where customers want to "hide" it (at least some of them) where others want to make sure it is seen and even change it from warning to error. Ideally we have something that can handle all of those requests. Since we are integrating into Veeam ONE in our next version, at this point in time, I think it would be best to handle those type of errors and their severity over there. Thoughts on that?

[AlexHeylin]

Hi Mike,
We've just run into this issue since a tenant told us to add a number of "function" mailboxes (not shared) to their backups, and now these warnings are causing our backup checks to fail every day since. This seems similar to warnings I was discussing with @Polina in veeam-backup-for-microsoft-365-f47/vbo- ... 80107.html

It seems to me that a solution would be to allow a set of options which the VB365 admin can set on how to deal with these situations. Global options would likely deal with most situations. There's already something similar being done in proxy.xml to handle other issues like this. While I'm not especially keen on the proxy.xml solution - I think SPs (and probably larger customers too) need something that enables them to control these behaviours.
Thanks

[Mike Resseler]

Good feedback, thanks for that. One more additional question on it. Would you like to see this per proxy, per organization, even more granular (although that will come with consequences)

[AlexHeylin]

I think per organisation would be most flexible.
Per proxy would probably do - and require less work by Veeam and SP (set it once and walk away).

If there could be a global default which the SP could set, then override on a per-org basis that would be ideal - but let's not make this so much work it never gets done. Any option would be better than now. Thanks.