Did you ever need to find in your Office 365 tenant :

• What object is using a specific email address or UserPrincipalName ?
• What object is preventing an Active Directory account from syncing because of duplicated email address or UserPrincipalName ?
• Where are them located in your tenant : in Users, in Contacts or in Deleted users ?

If yes, this article may help you achieve your goal. Find below how to process. To install the Microsoft Online Service Module for Powershell, please follow the instruction in the paragraph Connect with the Microsoft Azure Active Directory Module for Windows PowerShell of this link :

https://docs.microsoft.com/en-us/office365/enterprise/powershell/connect-to-office-365-powershell

When you are ready, open a Powershell console and Sign in to your Office 365 tenant with an Admin Account using this command line

Connect-MsolService

Run the below Powershell fonction :

function Get-ConflictingAttributes {

  [Cmdletbinding()]
  param (
    [Parameter(mandatory=$true)]
    [String]$SearchValue
  )

  $SearchTable = @{}
  Write-Host "Searching began :" $(Get-Date) -ForegroundColor Green

  #Searching in all ProxyAddresses
  Write-Host "Searching User and Guest accounts" $(Get-Date) -ForegroundColor Yellow
  $User = Get-MsolUser -All | Where-Object {($_.UserPrincipalName -match $SearchValue) -or ($_.ProxyAddresses -match $SearchValue)}

  #Searching in all deleted users
  Write-Host "Searching Deleted accounts" $(Get-Date) -ForegroundColor Yellow
  $Del = Get-MsolUser -All -ReturnDeletedUsers | Where-Object {($_.UserPrincipalName -match $SearchValue) -or ($_.ProxyAddresses -match $SearchValue)}

  #Searching in contacts
  Write-Host "Searching Contacts" $(Get-Date) -ForegroundColor Yellow
  $Contact = Get-MsolContact -All | Where-Object {$_.EmailAddress -match $SearchValue}

  Write-Host "Searching ended :" $(Get-Date) -ForegroundColor Green

  if ($User){
    $SearchTable.Add($User.UserType,$User) | Out-Null
  }

  if ($Del){
    $SearchTable.Add($Del.UserType,$Del) | Out-Null
  }

  if ($Contact){
    $SearchTable.Add("Contact",$Contact) | Out-Null
  }

  return $SearchTable

}

Now, suppose that you want to know which account in your Office 365 tenant is using the email address john.doe@koafric.com, it’ simple, run this command line in the Powershell console you previously opened :

$Result = Get-ConflictingAttributes -SearchValue "john.doe@koafric.com"

To see the result :

We can see that the object using the value “john.doe@koafric.com” is a contact and this value is set on his EmailAddress.

Hello, I’am sharing with you how to  manage Roles in Office 365 using PowerShell. It can be helpful for Office 365 administrators. The topics covered in this post are :

• List all administrative roles of your Office 365 tenant
• Find a user administrative role
• List a role members
• Add members to a role
• Remove members from a role
• Export Role member in a csv file

Ready, let’s go now…

First of all, connect to your Office 365 tenant

PS C:\> Connect-MsolService

If you don’t have PowerShell Module for Office 365 installed, follow this link.

List all administrative roles of your Office 365 tenant

PS C:\> Get-MsolRole

ObjectId                               Name                             Description                                                                                                         
--------                               ----                             -----------                                                                                                         
729827e3-9c14-49f7-bb1b-9608f156bbb8   Helpdesk Administrator           Can reset passwords for non-administrators and Helpdesk Administrators.                                             
f023fd81-a637-4b56-95fd-791ac0226033   Service Support Administrator    Can read service health information and manage support tickets.                                                     
b0f54661-2d74-4c50-afa3-1ec803f12efe   Billing Administrator            Can perform common billing related tasks like updating payment information.                                         
4ba39ca4-527c-499a-b93d-d9b492c50246   Partner Tier1 Support            Do not use - not intended for general use.                                                                          
e00e864a-17c5-4a4b-9c06-f5b95a8d5bd8   Partner Tier2 Support            Do not use - not intended for general use.                                                                          
88d8e3e3-8f55-4a1e-953a-9b9898b8876b   Directory Readers                Can read basic directory information. For granting access to applications, not intended for users.                  
29232cdf-9323-42fd-ade2-1d097af3e4de   Exchange Service Administrator   Can manage all aspects of the Exchange product.                                                                     
75941009-915a-4869-abe7-691bff18279e   Lync Service Administrator       Can manage all aspects of the Skype for Business product.                                                           
fe930be7-5e62-47db-91af-98c3a49a38b1   User Account Administrator       Can manage all aspects of users and groups, including resetting passwords for limited admins.                       
9360feb5-f418-4baa-8175-e2a00bac4301   Directory Writers                Can read and write basic directory information. For granting access to applications, not intended for users.        
62e90394-69f5-4237-9190-012177145e10   Company Administrator            Can manage all aspects of Azure AD and Microsoft services that use Azure AD identities.                             
f28a1f50-f6e7-4571-818b-6a12f2af6b6c   SharePoint Service Administrator Can manage all aspects of the SharePoint service.                                                                   
d405c6df-0af8-4e3b-95e4-4d06e542189e   Device Users                     Device Users                                                                                                        
9f06204d-73c1-4d4c-880a-6edb90606fd8   Device Administrators            Device Administrators                                                                                               
9c094953-4995-41c8-84c8-3ebb9b32c93f   Device Join                      Device Join                                                                                                         
c34f683f-4d5a-4403-affd-6615e00e3a7f   Workplace Device Join            Workplace Device Join                                                                                               
17315797-102d-40b4-93e0-432062caca18   Compliance Administrator         Can read and manage compliance configuration and reports in Azure AD and Office 365.                                
d29b2b05-8046-44ba-8758-1e26182fcf32   Directory Synchronization Acc... Only used by Azure AD Connect service.                                                                              
2b499bcd-da44-4968-8aec-78e1674fa64d   Device Managers                  Deprecated - Do Not Use.                                                                                            
9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3   Application Administrator        Can create and manage all aspects of app registrations and enterprise apps.                                         
cf1c38e5-3621-4004-a7cb-879624dced7c   Application Developer            Can create application registrations independent of the 'Users can register applications' setting.                  
5d6b6bb7-de71-4623-b4af-96380a352509   Security Reader                  Can read security information and reports in Azure AD and Office 365.                                               
194ae4cb-b126-40b2-bd5b-6091b380977d   Security Administrator           Security Administrator allows ability to read and manage security configuration and reports.                        
e8611ab8-c189-46e8-94e1-60213ab1f814   Privileged Role Administrator    Can manage role assignments in Azure AD, and all aspects of Privileged Identity Management.                         
3a2c62db-5318-420d-8d74-23affee5d9d5   Intune Service Administrator     Can manage all aspects of the Intune product.                                                                       
158c047a-c907-4556-b7ef-446551a6b5f7   Cloud Application Administrator  Can create and manage all aspects of app registrations and enterprise apps except App Proxy.                        
5c4f9dcd-47dc-4cf7-8c9a-9e4207cbfc91   Customer LockBox Access Approver Can approve Microsoft support requests to access customer organizational data.                                      
44367163-eba1-44c3-98af-f5787879f96a   CRM Service Administrator        Can manage all aspects of the Dynamics 365 product.                                                                 
a9ea8996-122f-4c74-9520-8edcd192826c   Power BI Service Administrator   Can manage all aspects of the Power BI product.                                                                     
95e79109-95c0-4d8e-aee3-d01accf2d47b   Guest Inviter                    Can invite guest users independent of the 'members can invite guests' setting.                                      
b1be1c3e-b65d-4f19-8427-f6fa0d97feb9   Conditional Access Administrator Can manage conditional access capabilities.                                                                         
4a5d8f65-41da-4de4-8968-e035b65339cf   Reports Reader                   Can read sign-in and audit reports.                                                                                 
790c1fb9-7f7d-4f88-86a1-ef1f95c05c1b   Message Center Reader            Can read messages and updates for their organization in Office 365 Message Center only.                             
7495fdc4-34c4-4d15-a289-98788ce399fd   Information Protection Admini... Can manage all aspects of the Azure Information Protection product.                                                 
4d6ac14f-3453-41d0-bef9-a3e0c569773a   License Administrator            Can manage product licenses on users and groups.                                                                    
7698a772-787b-4ac8-901f-60d6b08affd2   Cloud Device Administrator       Full access to manage devices in Azure AD.                                                                          
10dae51f-b6af-4016-8d66-8c2a99b929b3   Guest User                       Default role for guest users. Can read a limited set of directory information.

Find a user administrative role

PS C:\> Get-MsolUserRole -UserPrincipalName user1@mydomain.com

ObjectId                               Name                             Description                                                                                                         
--------                               ----                             -----------                                                                                                         
62e90394-69f5-4237-9190-012177145e10   Company Administrator            Can manage all aspects of Azure AD and Microsoft services that use Azure AD identities.

List a role members

Get the role objectId

PS C:\> $role = Get-MsolRole -RoleName "User account Administrator"
PS C:\> $role.ObjectId 
Guid                                
----                                
fe930be7-5e62-47db-91af-98c3a49a38b1

Get role members

PS C:\> Get-MsolRoleMember -RoleObjectId $role.ObjectId

RoleMemberType EmailAddress                   DisplayName                        isLicensed
-------------- ------------                   -----------                        ----------
User           user2@mydomain.com             user2                      	 True      
User           user3@mydomain.com             user3                    		 True      
User           user4@mydomain.com             user4                    		 False

Add member to a role

PS C:\> Add-MsolRoleMember -RoleObjectId $role.ObjectId -RoleMemberEmailAddress user5@mydomain.com

Remove member from a Role

PS C:\> Remove-MsolRoleMember -RoleObjectId $role.ObjectId -RoleMemberEmailAddress user3@mydomain.com

Check member removal

PS C:\> Get-MsolRoleMember -RoleObjectId $role.ObjectId

RoleMemberType EmailAddress                   DisplayName                        isLicensed
-------------- ------------                   -----------                        ----------
User           user2@mydomain.com             user2                      	 True      
User           user4@mydomain.com             user4                    		 False      
User           user5@mydomain.com             user5                   		 False

To export Role member in a csv file, use the below command

PS C:\> Get-MsolRoleMember -RoleObjectId $role.ObjectId | Export-Csv -Path C:\MyRoleMembers.csv -Encoding UTF8 -Delimiter ";"

Voilà 🙂