Automating Microsoft 365 Documentation in Syncro
Last updated
Last updated
Documenting customer Microsoft 365 environments can be extremely tedious and time consuming. Keeping that information up to date is also a heavy task to manage. I wanted to create some scripts that would automate and update documents in Syncro that are tied to your customer environments. For this reason I create a some scripts that perform the following:
Microsoft License Information => Displays all current licensed and unlicensed users as well as showing what licenses are available vs. consumed
Microsoft MFA Status => Displays MFA status, Conditional Access Policies, and DUO MFA custom controls
Microsoft Exchange Information => Displays mailbox usage in GB, last login time, mailflow rules, DKIM Config, and ATP policies
Microsoft Intune Information => Displays enrolled devices, compliance status, OS version, Autopilot info, encryption, and Assigned Apps
Microsoft Contact Creation => Creates a contact on the customer record in Syncro for Active 365 Users
All documentation is listed for the customer and contacts are automatically added or updated to the customer record.
All of my scripts can be found at the following repository
The license report displays all active and consumed licensing as well as all licensed and unlicensed users
This report shows you all users MFA status. Since Microsoft has evolved their MFA registration over time there are now 3 different ways in which a user could have MFA enforced.
Legacy MFA Portal (where you see Enabled, Enforced, Disabled)
Conditional Access Policies
Security Defaults
For this reason I include two columns that shows if a user has registered with one of these methods (I am able to see Security Defaults and Conditional Access Registration in a combined output). Here I also show the names of all Conditional Access Policies and also an additional filed that shows if you have DUO listed as a custom control in any conditional access policy
For the exchange report, I show mailboxes, active consumption in GB (in a descending order), last login time, mailflow rules, DKIM Configuration, and ATP Settings/Policies
The Intune report contains a summary of device compliance, devices, and all apps that are in an assigned state
Microsoft 365 Users are created as contacts for a customer if they do not already exist. If the user is not longer in 365, then a note is added to an existing contact to say that they are no longer active. (Wish there was a flag or something for this in Syncro as it wasn’t the best way to show removal of users)
You will need to garner tokens and GUIDs from both the Secure Application Model and Syncro. The secure application model allows for a headless connection into all of your customer environments. The script to run that can be found from Kelvin over at CyberDrain. Click here to go to that page in Github. In Syncro you will need to create a new API Key that has permissions to customers and documentation to perform the necessary read and write actions. Click Here for Syncro’s Documentation on generating a new API key. The only other variable you will be prompted for is your Syncro subdomain. This is simply just the prefix of the URL you go to when signing in. Ex:
