This blog is designed to show you how to apply rules to users or groups and how to confirm the policies were actually applied to the users.
There are some pre-requisites that will be required for part of this testing. Listed below are what you will need prior to testing
Creating a rule is a straight forward process but can get a little more complex with the more rules you add. It is important to note that there are priorities for each rule. The top rule being the most restrictive and the lower rules down to the bottom would get less granular and more global.
To visualize this imagine we have 3 accounts as follows:
We can say that Contactors are temporary employees to your company and generally do not require full access to Skype for Business Online. Where Managers and End Users would have more access in the environment.
With this example, we can limit our contractors through a Rule for contractors to do something like disabling federation and their display picture as well as allowing them to do External Calling from their mobile device.
Let’s go ahead and create the first rule. To do this try the following:
Depending on the amount of users in your group or manually selected this can take some time to complete. Once it is completed you will see a green checkmark on the rule.
After the rule completes there we send the command to the Skype for Business Online service and then it will process the request to clients. The time it takes to apply the rule settings varies per tenant and rule you created. We have seen it take as little as 30 seconds and as long as 10 or more minutes. The client will also need to be logged out and back in before the change will take effect for that user.
Confirming the policy was applied
Now that we know it can take some time for the policy to apply, how do we know for sure that it applied?
We can use remote PowerShell and the Skype for Business Online Module to check this. Look back to the pre-requisite section and make sure you have completed steps 1 through 3 before moving forward or you may run into some unexpected errors.
Let’s confirm our changes took effect by doing the following:
#Where sip uri would look like this: "FirstName LastName"
Another way to test this would be to log into the Skype for Business client as one of the impacted users and look up someone that is federated to your company. The should not be able to message them or see their display photo.
And that’s it! Now you should feel comfortable applying a single rule and confirming it is in fact on the user.
Now that we are pro’s at setting up a single rule. How do you set up a second rule? The great news is it is exactly the same as creating the first rule. However, now we need to think about how this rule is going to impact the users involved.
Sticking with our example, we have restricted our contactors to internal messaging only but allowed them to make external calls from their mobile device. Now we would like to limit our internal users to not allow External Calling on their mobile devices.
We have to think about how this rule will affect our internal users and contractors as we have one rule already.
Let’s think about what we have configured in the first rule. This rule is restricted to just the contractors so it should not affect our internal users. However, if our contractors are in any groups we add to the second rule, this policy then could impact them. We want to disable users mobile calling but yet we have allowed the contactors to do this.
Rule priority now takes a part in where we place the second rule. As we described earlier, the first is the highest priority and the second rule will only apply to those not in the first rule, the third rule is even more global than the second rule and so on.
If we place this new internal users rule first, than we will actually restrict the contactors mobile calling if they fall into the scope of this rule. We do not want that to happen. If we place the contactors rule first, it will have the highest priority and take precedence over all the other rules. Which means the settings in the first rule wins over the second rule.
This sounds more like what we want to do. Let’s go ahead and create our second rule with the Mobility policy set to “MobilityDisableOutsideVoice”. Give it a proper name, set your users/groups and Save the rule.
Notice this time we did not enable the rule first? This is to make sure we do not accidently apply the rule to users before making sure our rule priority is correct. If the rule priority is correct, you can select that internal users rule, click Enable and Save. If the rule priority is not correct, you can grab the dotted section to the left of the rule name and drag them to the right order, then Enable and Save the rule to active it.
Congratulations! You now should be able to setup multiple rules and manage the priority of your rules to ensure they are applying in the correct order. You also now armed with a PowerShell command to list the policy for any user to confirm they are applying properly.