Stream Mobile App Cut from July 1, 2024

Microsoft’s announcement in message center notification MC789607 (2 May) that they plan to retire the Stream mobile client for iOS (Figure 1) and Android on July 1, 2024, is not unexpected. It follows the completion of the long-running migration from the Stream Classic platform to Stream on SharePoint on April 15, 2024.

The (sparse) documentation for the change says that Microsoft is retiring the Stream mobile client as they “continuously strive to improve and unify our services.” More likely it’s simple rationalization. How many mobile apps does Microsoft need to upload and view videos stored in Microsoft 365. And because the focus of video storage is now OneDrive for Business and SharePoint Online, the OneDrive app was never going to be rationalized, even if its mission to handle all file types means that it pays less attention to video than a dedicated video app. The same is true for the Microsoft 365 mobile app, the other alternative nominated by Microsoft.

Microsoft says that their future investment will be in the OneDrive and Microsoft 365 mobile apps. Presumably this refers to investments to improve support for video files rather than just generally.

Block Download Policy

In MC789607 Microsoft calls out a potential change in behavior that users might encounter. The Stream mobile app doesn’t support the SharePoint Online block download policy, which is designed to block downloads of sensitive material from sites. The OneDrive and Microsoft 365 apps do apply the policy, meaning that users are forced to watch videos online if files are stored in sites protected by the block download policy.

I’m not sure that this will be a big concern for many customers because the block download policy is designed to protect sensitive sites that probably don’t hold many videos. I might be wrong, and there’s certainly a case for protecting videos about new products and other confidential material, but in the general course, I think the majority of the 400 mil users won’t notice any difference in viewing videos.

Usage of the Stream App

A note in the announcement says:

“If you would like more information about how many users in your organization are using the Stream mobile apps, please email us at streammobileapp@microsoft.com.”

If you think this seems a tad odd, you’d be right. It’s very strange to send email to a Microsoft development group to ask them to provide information about the usage of an app within a tenant. I bet that the folks lined up to process these emails really appreciate the chance to extract statistics for tenants.

What this statement underlines is the lack of usage data published for Stream in the Microsoft 365 admin center or available through the Graph Reports API. Stream is not alone in this respect. Despite having a usage dashboard in the Microsoft 365 admin center, Copilot for Microsoft 365 is a notable absence in the list supported by the API.

Retiring the Steam Mobile App is a Bump in the Road

Overall, I suspect that the retirement of the Stream mobile app will be a bump in the road: unnoticed by most but a pain for those who hit it. Rationalization occurs all the time and given the size of Microsoft 365 and the number of workloads it spans, it’s likely that good candidates exist for future rationalization. Expect similar stories to emerge in the future.

Thanks to Microsoft for announcing a change like that just after we shipped the May 2024 update for the Office 365 for IT Pros eBook. The only good thing about changes like this is that they show the value of a book that’s constantly updated to stay up-to-date with what happens inside Microsoft 365.

Final Retirement of the Teams Classic Client in July 2025

The current Teams classic client is the last iteration of the original client launched in preview in November 2016 as a “chat-based workspace” (Figure 1) Teams reached general availability in February 2017 and remained the focus for customers until the arrival of the preview of the Teams 2.1 client (code name “Emblem”) in March 2023.

Why version 2.1 instead of Teams 2.0? Well, the Teams 2.0 client was the first run at a new architecture that appeared as the chat client in Windows 11. That client lacked any of the enterprise features that Teams built its 320 million installed base on, and really wasn’t very good. That problem is addressed in the single desktop application “unified Teams client” (Microsoft 365 roadmap 383006), which is now rolling out.

Many Changes Since 2016

The elements of the original Teams client from 2016 are recognizable when compared to the final release of the V1.0 client but so much changed over the seven years of active development. The most notable

• Worldwide deployment to support customer data residency needs.
• Scalability improvements from the original 600-member limit for a team to 10.000.
• Support for compliance functionality like retention, data loss prevention, and communications compliance policies.
• Massive change and increased functionality in calling, meetings, and webinars, including the migration from Skype for Business Online and the introduction of the Teams Phone ecosystem.
• Shared and private channels, and up to 1,000 channels per team.
• Support for automation through PowerShell module and Graph APIs.
• Development of the Teams app ecosystem, including app setup and permissions policies and bulk deployment.

All the above happened using the original Electron-based client. Soon after its release, Teams took over from Outlook as the favorite example of a piggy application when it came to the consumption of workstation resources. Increased functionality extracts its price, but Electron added more on top.

Teams Classic Client Retirement Schedule

Which brings us to message center notification MC783985 (23 April 2024), which lays out the retirement schedule for the classic Teams client.

On July 1, 2024, the Teams classic client exits support. Users will see nagging messages to remind them that support is no longer available. This “helpful” communication has already started (Figure 2) to join the other annoying messages surfacing in Teams.

Starting on October 23, 2024, Microsoft will block use of the classic client on older platforms such as Windows 7 (still heavily used by large organizations), Windows 8 and 8.1 (ignored by most), and macOS Sierra (10.2). Users of these platforms can switch to the new Teams browser client, but can’t use the new client because of the requirement to use Windows 10 version 10.0.19041 or higher or macOS Monterey (12) or higher.

On July 1, 2025, the Teams classic client reaches “end of availability” and is blocked. Users who attempt to use the classic client see a non-dismissible dialog telling them that they must upgrade. Those using supported platforms can choose between the new client desktop or browser versions. It’s worth noting that Microsoft now supports the new client with the Firefox browser for Windows, macOS, and Linux and the Safari browser for macOS. Previously, the new client only supported Chrome and Edge.

Smooth Transition to Teams 2.1

I haven’t heard of many issues as organizations make the transition to the new Teams client. The new client is faster, consumes fewer resources, and boasts a wonderful account switching capability that makes it much easier to move between tenants. You can even run the new client with a classic skin to make it look like the old client.

Some issues remain for Microsoft to resolve, but that’s always the case in software transitions. Balancing the lack of some features that exist in the old client and are not yet in the new are the introduction of new functionality like enhanced noise suppression during meetings (MC780744) and intelligent message translation for chats (MC748379). A trnslation capability for Teams channel conversations and chats has existed since 2018, so I’m not quite sure what the “intelligent translation” means, especially when translation doesn’t work sometimes. Figure 4 shows the same message sent twice to a group chat. One translated, one didn’t.

I guess the intelligence comes from the way that translation happens automatically if you configure this in Teams Settings. And to be fair, it does work – most of the time. The joys of software…

Learn about using Teams and the rest of Office 365 by subscribing to the Office 365 for IT Pros eBook. Use our experience to understand what’s important and how best to protect your tenant.

Microsoft to Retire Delve in December 2024

Posted on December 14, 2023, message center notification MC698136 announces the sad news that Microsoft will retire the Delve web app (“Office Delve” was the original name) from Microsoft 365 on December 16, 2024. The demise of Delve (Figure 1) isn’t altogether surprising because the app never achieved much traction.

Launched as codename “Oslo” at the SharePoint 2014 conference, Delve was the first of a planned set of Office 365 next generation portals. In the case of Delve, Microsoft said that it would “reimagine search.”  While this mightn’t have happened, Delve introduced some interesting and worthwhile functionality. It was the first app to exploit the power of the Office Graph (now the Microsoft 365 Graph) to calculate and expose relationships between people and their work.

Delve Exposed Documents

When Delve used the Graph to calculate popular documents and display that information users, it caused n uproar in some quarters because people saw information that they shouldn’t. The problem wasn’t due to Delve. Instead, it happened because of inconsistent, inaccurate, or missing permissions on SharePoint Online sites that allowed the software to find interesting documents. The same issue might recur with Microsoft 365 Copilot with the big difference that documents accessible to Copilot can be used to generate text. There’s quite a difference between suggesting documents to users and ingesting documents to create new content,

On a more positive note, Delve allowed users to edit their profile and update their photo at a time when that experience was dreadfully fragmented across Exchange, Lync, and SharePoint. Microsoft is only now moving to an Entra-ID based solution that they hope will deliver consistent user photos across Microsoft 365. And Delve introduced a way for users to highlight documents by pinning them to boards. Overall, Delve seemed important enough to warrant a dedicated chapter in the Office 365 for IT Pros eBook over several editions.

Chipping Away at Delve Functionality

Time moves on and technology evolves. Delve’s problem was that it didn’t evolve quickly enough (or at all). Some of its functionality, like blog publishing, vanished in 2020 followed by its desktop app (killed in March 2021). Delve Analytics (always more of an add-on rather than an integrated component) broke away to become MyAnalytics (now exposed through the Viva Insights app and add-in). Microsoft’s attention turned elsewhere, and Delve didn’t occupy a compelling and important role in the Microsoft 365 ecosystem, and that’s what brings us to its demise in 2024.

No Replacement for Delve Features

Microsoft doesn’t think that there is a need to replace the functionality currently available in Delve. To help users manage their profiles, Microsoft says that they plan to deliver a new edit profile capability in mid-2024 that is “tightly coupled with profile cards.” I’m unsure why they feel the need to assert the closeness of the connection given the pervasiveness of the user profile card across Microsoft 365 apps. A replacement for the Delve organization view is available in the user profile card and the Org Explorer (with the necessary licenses). Unsurprisingly given the sad lack of development since 2015, there’s no replacement for Delve Boards.

Lack of Functionality and Development

Even though I never had much use for Delve, I think Microsoft got some value from the app. We didn’t know much about the Graph in 2014-15. An app had to demonstrate what Microsoft meant by reimagining the way people searched for information together with the value of discovering information that could be useful to a person by reference to the connections that exist between that person and others within an organization. Delve did both, but I guess its flaw was that there wasn’t much else that users could do aside from pinning documents to boards.

It seems like Microsoft lost interest in Delve some years back. For whatever reason, it’s going to join other apps like StaffHub, Cortana Scheduler, Kaizala, and Sway in the Microsoft 365 wastebasket. All had some interesting aspects, but all eventually failed to appeal to the masses.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

1 October 2026 Retirement Date Set for Exchange Web Services

On September 19 2023, Microsoft announced their intention to retire the Exchange Web Services (EWS) protocol on 1 October 2026 and replace it with Graph APIs. The retirement only affects non-Microsoft apps. Microsoft 365 apps like Teams can continue to use EWS to read data from Exchange Online mailboxes. EWS continues to be supported for Exchange Server as the Graph API is unavailable for on-premises servers.

Three years seems like a long way off. However, an extended period is needed by app developers to convert EWS code to Graph API requests. There shouldn’t be much difficulty in recreating code dealing with accounts, mailboxes, and calendars. Microsoft knows that the problems lie in areas not covered by the Graph API, such as archive mailboxes and public folders.

The Management Gap

Two particular topics deserve comment. First, if you’ve used EWS to develop management tools for Exchange, it’s likely that you’re going to find big gaps. Over recent years, the Exchange developers have concentrated on modernizing the Exchange Online management PowerShell module to remove dependencies like WinRM, remove support for basic authentication, and make the most heavily used cmdlets more robust and reliable. There’s no doubt that Exchange PowerShell works better now than it did, but a gap exists in coverage of Exchange management within the Graph APIs. There are many actions in the Exchange admin center that can’t be performed through a Graph request.

You might be able to bridge the functionality gap with PowerShell cmdlets, but if you want to swap EWS code for Graph code, you’ll probably have to wait until Microsoft extends support for management operations to the Graph APIs.

The Backup Conundrum

Microsoft did not design EWS to function as a backup/restore mechanism. Even so, the lack of a formal backup API for Exchange over the years led backup vendors to develop products around EWS. This situation persists today as all backup products currently available for Exchange Server and Exchange Online use EWS (Microsoft’s announced but not yet available Syntex Backup for Exchange Online uses a different API).

Other ISVs use EWS to move data into Exchange Online. Examples include transferring data migrated from a legacy archive system or tenant to tenant migrations.

Discussion of how EWS-based data transfer products can move to a replacement API was notably missing from Microsoft’s announcement. The simple fact is that Microsoft has no publicly-available backup API for Exchange Online. One needs to be created and tested to ensure that it works as least as well as EWS (which has some issues with throttling and robustness) before a transition is possible. There’s no word on such a replacement yet. And Microsoft’s saying nothing either about the possibility that any replacement will be a metered (paid-for) API such as the Teams Export API. Hopefully, Microsoft will ensure that any transition for ISVs away from EWS to replacement APIs will be cost neutral.

Well-Known Gaps Remain Unclosed

The gaps discussed here are not unknown. Customers and Microsoft have debated what’s missing for Exchange in the Graph APIs for several years but little has happened to close the gaps. A certain scepticism exists that Microsoft will suddenly swing into action to produce a bunch of updates to support Exchange Online management, archive mailboxes, and so on. The ball is in Microsoft’s court to prove to the development community and customers that Exchange Online has truly embraced the Graph APIs for all aspects of the product. Let’s hope that they get the work done.

Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.

Need Recedes for Unified Labeling Client

On April 11, Microsoft announced that they will retire the AIP client, aka the Unified Labeling client, aka the AIP add-on for Office, on 11 April 2024. The add-on has been in maintenance mode since January 1, 2022, so its final retirement was only a matter of time. Once retirement happens, users cannot assign sensitivity labels to documents through the add-on.

A Long Road

In 2016, when I first started writing about how to protect Office documents with labels, the labels were called Azure Information Protection labels and users needed to install the add-on to add elements like the information protection bar and the code to apply rights management to documents. The situation was natural because Azure Information Protection was a separate product that targeted Office but had no formal alignment with Office development. The add-on was only available for Office on Windows.

Things changed when Microsoft decided that sensitivity labels were strategically important to Office 365, which meant that they needed to build support for sensitivity labels across the infrastructure in apps like SharePoint Online and Exchange Online and desktop, browser, and mobile apps. Sensitivity label support is now broad and deep across Microsoft 365, including for container management of sites, groups, and teams. Regretfully, sometimes Microsoft demands additional licenses for features that seem very basic, such using the Syntex-SharePoint Advanced Management license to control the assignment of default sensitivity labels to SharePoint document libraries.

In 2019, Microsoft started the process of removing the add-on by incorporating the code to handle sensitivity labels in the Office applications (native mode protection). The goal is to provide the same or better functionality in the out-of-the-box Microsoft 365 apps for enterprise (Office desktop) versions of Word, Excel, and PowerPoint. Microsoft says that the Microsoft 365 apps for enterprise “now have most of the capabilities found in the AIP Unified Labeling add-in for Office as well as advanced capabilities not possible with the AIP Unified Labeling add-in for Office.” The most important of these capabilities are:

• PDFs exported from the Office apps retain protection applied by sensitivity labels.
• Sensitivity labels can protect meeting invitations (including attachments) and responses.
• Account switching.
• Users cannot disable labeling controls.

Microsoft has long stressed that incorporating code from the Microsoft Information Protection SDK to make applications natively aware of information protection leads to better performance and increased stability. In other words, something that’s built-in is likely to work better than when an application needs to load in external code.

Native protection is only available with the subscription versions of Office. The functionality isn’t supported by perpetual versions of Office like Office 2019.

Making Changes to Ease Migration

Technologies that affect how people work are usually harder to migrate to new platforms than background processing is. Changes to Office applications are good examples of the truth of this assertion (as anyone who remembers the introduction of the ribbon in Office 2007 can attest).

As an example, the add-on features an information protection bar that people like. The Microsoft 365 apps don’t use the information protection bar. Instead, Microsoft has changed the menu and title bars of the Office apps to highlight labels in a different way, including displaying different colors for different labels. The latest tweak is in Outlook desktop, where the latest builds feature a prominent new button to allow users to more easily assign a sensitivity label to emails (Figure 1).

Other Azure Information Protection Elements

I stopped using the unified labeling client two years ago. However, I have installed the unified labeling client on PCs to get other elements that came with the add-on such as the Azure Information Protection PowerShell module and the ability to classify and protection files from the Windows Explorer. The PowerShell module is especially helpful when the need exists to remove sensitivity labels from files.

Microsoft says that they are not retiring these elements, nor are they retiring the viewers that allow people to view protected content on Windows, iOS, and Android, or the Azure Information Protection Scanner. Microsoft says that following the retirement of the add-on, they will remove it from the installable package available in the Download Center. User will be able to install the new version of the package to access the other elements, which will also be rebranded as Microsoft Purview capabilities.

Time to Move On

The unified labeling client or add-on for Office has served its purpose. It’s time to let it go and migrate as quickly as possible to use the built-in capabilities that exist in Office. Apart from the small fact about the retirement, it’s clear that Microsoft has poured engineering effort into building out the sensitivity label infrastructure across Microsoft 365 for the last several years. Benefit of that work isn’t available to the add-on, which is a good a reason to move on as anything else.

So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across Office 365. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.

Azure Automation for IT Pros

I’ve spent a lot of time working with Azure Automation over the last few years. It’s an extremely useful facility for tenant administrators who want to run PowerShell scripts using a more modern mechanism than offered by Windows Scheduler. This is especially true so in large tenants where processing hundreds or thousands of objects is common, which is why I started to use Run As accounts with Azure Automation.

Converting scripts to run on Azure Automation isn’t too difficult, once you understand the headless nature of the beast and that PowerShell runs on virtual machines spun up for the purpose. The biggest issue often faced when moving scripts from running interactively to being an Azure Automation runbook is how to create output from scripts, but it’s possible to send email, post to Teams channels, and create files in SharePoint document libraries.

Microsoft seems to communicate with developers and administrators (aka IT Pros) in different ways. For instance, the news about the retirement of Azure Automation Run As accounts on September 30, 2023, didn’t appear in any notification in the Microsoft 365 admin center. In fact, apart from the notices posted in Azure Automation documentation (like that shown in Figure 1), I can’t find a formal announcement from Microsoft.

Informing the Technical Community About the Run As Retirement

The possibility exists that I might not be looking hard enough. Normally, I am reasonably proficient with search (Google), but the first hit I find is a 27 September 2022 Microsoft Answers post saying “On 30 September 2023, we’ll retire the Azure Automation Run As account that you use for Runbook authentication.” I can find an earlier “plan for change” note for July 2022 in the What’s new in Azure Automation page. Apart from that, Microsoft seems to have updated the documentation on 18 October 2022 (here’s the FAQ).

I suppose that it’s reasonable to expect people to learn about developments from documentation. In this instance, I think Microsoft dropped the ball and didn’t do a great job of telling people what’s going to happen when Run As accounts retire.

Managed Identities Are a Better Solution

The logic for retiring Run As accounts is undeniable. A better and more secure solution (managed identities) exists. Run As accounts authenticate using a self-signed certificate that needs to be renewed yearly. Microsoft has removed the ability to renew these certificates from the Azure portal, meaning that Run As accounts are counting down to a time when they won’t be able to authenticate. Microsoft has a script to renew certificates for Run As accounts and the script will run after September 30, 2023. However, Run As accounts will then be unsupported, which isn’t a great situation for production components.

The nice thing about managed identities from an Office 365 perspective is that the important PowerShell modules used for automation support managed identities. Some do so very smoothly (like the latest Exchange Online management module, where even the latest RBAC for applications feature supports managed identities) and some do it with a little extra work. For example, V1.0 of the Microsoft Graph PowerShell SDK needs to get an access token from the Azure Automation account that owns a managed identity while V2.0 will be able to sign in using a managed identity. Here’s an example of a simple runbook that:

• Connects to the Azure Automation account using a managed identity.
• Gets an access token from Azure AD.
• Uses the access token to connect to the Graph with Connect-MgGraph.
• Retrieves the service domain (like office365itpros.onmicrosoft.com) using the Get-MgOrganization cmdlet.
• Uses the service domain and a managed identity to connect to Exchange Online.
• Lists details of user mailboxes.

# Connect to Microsoft Graph with Azure Automation
Connect-AzAccount -Identity
$AccessToken = Get-AzAccessToken -ResourceUrl "https://graph.microsoft.com"
Connect-MgGraph -AccessToken $AccessToken.Token
# Get Tenant service domain using Get-MgOrganization
$TenantName = (Get-MgOrganization).VerifiedDomains | Where-Object {$_.IsInitial -eq $True} | Select-Object -ExpandProperty Name
# Connect to Exchange Online
Connect-ExchangeOnline -ManagedIdentity -Organization $TenantName 
Get-ExoMailbox -RecipientTypeDetails UserMailbox | Format-Table DisplayName, UserPrincipalName

When V2.0 of the Microsoft Graph PowerShell SDK is available, you’ll be able to replace the first three lines of code with a simple Connect-MgGraph -Identity.

Another example of using a managed identity with Exchange Online is to monitor events gathered in the audit log to detect and report events that might indicate potential tenant compromise. Running the script on an Azure Automation schedule makes sure that audit events are checked without human intervention.

Time to Move Forward

Apart from the poor communication, I don’t have any problem with Microsoft’s decision to retire Run As accounts. They worked as a mechanism to connect resources to Azure Automation. We’re just moving on to adopt a new approach. Microsoft documents the migration steps to move from a Run As account to use managed identities. It’s a manual process, but not onerous.

Service Shuts Down on July 31, 2021

A process started in September 2017 with the announcement at the Ignite conference that Teams would replace Skype for Business Online will conclude on July 31, 2021 when Microsoft retires Skype for Business Online. Existing tenants using Skype for Business Online can continue using it until they can transition to Teams.

New customers won’t get a choice as Microsoft will only configure new Office 365 tenants with Teams from September 1, 2019. New tenants with fewer than 500 seats have been unable to choose Skype for Business Online since last year.

To be fair to Microsoft, they have made huge progress in developing Teams to be able to take over from Skype for Business Online since the 2017 announcement. All the data indicates that Teams is obviously successful with customers, with over 19 million monthly active users in over 500,000 organizations. Now that a firm retirement date is set for Skype for Business Online, we can expect to see that number grow fast.

Feature List in Teams Expands All the Time

The list of new features delivered in Teams since 2017 is staggering and Microsoft is lining up to add the last remaining set of features needed to enable customers to make the move, including dynamic 911, shorter retention periods (down to one day) for compliance records, and better interoperability between Teams and Skype consumer (due in the first quarter of 2020). That last point mightn’t seem important, but it’s critical for many companies who want to connect with partners and customers who don’t have Teams.

Preparing for Retirement

As the retirement date for Skype for Business Online approaches, you can expect:

• A huge effort by Microsoft to convince Office 365 tenants using Skype for Business Online to move to Teams. The last thing Microsoft wants is to have a substantial number of reluctant movers left as July 31, 2021 draws near. If you use Skype for Business Online today, expect to hear from Microsoft.
• Microsoft will work out edge case scenarios like what happens to new tenants after September 1 who have Skype for Business on-premises servers and want to have a hybrid organization.
• ISVs to speed up the delivery of more Teams phone and room devices to help customers switch out old devices designed for Skype for Business Online.
• A ramp-up of migration services offered by Microsoft and third-party consulting companies. Remember that Teams is very different to Skype for Business Online, and switching in Teams as a 1-for-1 replacement isn’t a good strategy. It’s much better to figure out how Teams fits in your overall collaboration strategy first. And remember to consider questions like data governance and compliance when you deploy Teams too.

We have a whole chapter (16) covering the transition from Skype for Business Online in the Office 365 for IT Pros eBook. You should think about reading it!