Plus Addressing in Microsoft 365

Plus addressing is now available for Exchange Online and can be enabled using PowerShell.

What is Plus Addressing?

Plus Addressing allows you to create disposal email addresses based on a combination of your own email and anything after the ‘+’ sign. For example, take a user with an email address of ‘user.one@365rocks.org‘. The part before the ‘@‘ symbol is unique to the user in Exchange Online and can be used to sign up for various services such as alerts and newsletters.

With Plus Addressing, the user can add a tag to the unique part of the email address such as ‘user.one+<tag>@365rocks.org‘ where ‘<tag>‘ can be replaced with any word the users choosing. i.e. When signing up for competitions, the user can enter the address ‘user.one+competitions@365rocks.org‘.

Word of warning, some online forms may not accept plus addressing if there are additional verification checks being applied to the forms email fields.

What happens next?

When an email is sent to the new address, Exchange Online will ignore the ‘+<tag>‘ portion of the address and deliver the message to the original ‘user.one@365rocks.org‘ mailbox.  You can then use the email address to create rules and filters to handle the different messages.

How do I enable Plus Addressing?

This is not enabled in your 365 environment by default and requires the setting to be change via PowerShell.  To enable this, download the latest version of the Exchange Online Management Module.

This can be imported using

Import-Module ExchangeOnlineManagement

Connect using the command shown below replacing the ‘ExchangeAdmin@365rocks.org‘ username with a suitable account which has the Exchange Administration role in your environment.  

Connect-ExchangeOnline -UserPrincipalName ExchangeAdmin@365rocks.org

Once authenticated, the command to enable Plus Addressing is 

Set-OrganizationConfig -AllowPlusAddressInRecipients $true

The feature can also be disabled by replacing $true with $false if required.

Part 3 – Creating an auto attendant in Microsoft Teams

Creating the auto attendant

From the Microsoft Teams admin centre, select “Voice” > “Auto attendants” and click “Add”. We’re going to create a simple auto attendant and then come back to configured later. Name the auto attendant, in this example we’ve used the name “Reception” and configure the “Time Zone”, “Language” and “Enable voice inputs” option as you wish. “Enable voice inputs” switches on the ability for voice recognition for selecting options by the caller in the chosen language. Do not configure the optional “Operator” setting as this time, in fact if you try to set this option, the “Reception” account will not yet be available as a resource account.

On the subsequent screen, leave the default settings and click “Submit” to complete the creation.

Assigning the resource account to phone number

From the Microsoft Teams admin centre, navigate to “Org-wide settings”> “Resource accounts” and highlight the “Reception” account created earlier. Click “Assign/unassign” and configure as follows;Phone number type should be selected as “Online”, the number obtained earlier can be added as the “Assigned phone number” and the “Reception” auto attendant will be available via searching for the “Assigned to” option.

Configuring the auto attendant

Now we have everything in place, we’re going to configure the auto attendant created earlier based on the following flow;

Updating the auto attendant

When the auto attendant is selected again from the Microsoft Teams admin centre, the first thing to notice is that the telephone number is now populated which means that the “Operator” can now be set as “Voice App” and the “Reception” account can be selected.

On the next screen, you can choose a greeting message by either typing the message and allow an automated voice will read it, or for a more professional approach record and upload your own.

Audio files must be less than 5MB and in either MP3, WAV or WMA format.

Creating the menu options

After the greeting has played, you can choose to disconnect the call, redirect the call or play menu options. Based on the flow above, for this tutorial, we’re going to create and play menu options to the caller. We’ve added 3 simple menu options based on the example flow and have created the message but again, a recorded message can be used.

We’ve assigned the menu options here to 3 users with applicable licences and have disabled the “Directory search”. When enabled, this would allow callers to dial an extension number or search using the letters on the phone’s keypad.

Next you can set business hours and what should happen to any incoming calls outside of these hours. Here we’ve set the hours to Monday – Friday and 09:00 to 17:00. Should you wish, a separate greeting can be play and if needed, another set of menu options can be configured.

Public holidays can be added in advance with customised messages and or redirections. If there’s no further configuration required, at this point you can click “Submit”.

At this point, you should now be able to dial the number assigned and test your new virtual reception.

In this tutorial we’ve setup a very basic auto attendant to mimic a virtual reception with just 3 options but the configuration doesn’t have to be that limited. Other possibilities are as follows;

  • Route calls to additional auto attendants based on chosen options
  • Route calls to multiple users in a department at once
  • Send calls outside of hours to a shared voicemail

This tutorial has been split into the following posts;

Part 1 – Background and licencing
Part 2 – Resource accounts and auto attendant numbers
Part 3 – Creating and configurating the auto attendant (this post)

Disclaimer: Details are correct at time of publishing.

Part 2 – Creating an auto attendant in Microsoft Teams

What is a resource account?

A resource account is a special type of account created in your Microsoft Office 365 tenant as a disabled object and is used to represent items such as meeting rooms or equipment. This means that the account has limitations and cannot be logged in like a standard user account.

Why is this needed?

In Microsoft Teams, auto attendants need at least 1 assigned resource account to enable the service.

How do I create a resource account?

A resource account can be created directly from the Microsoft Teams admin centre (https://admin.teams.microsoft.com). From the admin centre, click “Org-wide settings” > “Resource accounts” > “Add” to create a new resource account. Give the account a display name, username (ensure you use the correct domain name if your tenant has more than 1 assigned) and select “Auto attendant” as the “Resource account type”.In this tutorial, we have named our account “Reception” and have provisioned the display name as the same.

Assigning the licence

Once confirmed, a “Microsoft 365 Phone System – Virtual User” licence can be assigned to the resource account just created.From the Microsoft 365 admin centre (https://admin.microsoft.com), select “Users” > “Active users” and select the account “Reception” created earlier. Add the new “Microsoft 365 Phone System – Virtual User” licence to the account and click “Save changes”.

Generating auto attendant numbers

You’ll need a number for people to call, if you have an existing company number this can be transferred or “Ported” but for the purposes of this tutorial a new number is requested from the Teams admin centre > “Voice” > “Phone numbers” > “Add”. More information on transferring existing numbers can be found in the Microsoft article “Transfer phone numbers to Microsoft Teams”.

In the screenshot below, we have requested a new “0203” prefixed number based on the location of “London, United Kingdom”. The type of number has been requested as “Auto attendant (Toll)” which means the person calling pays for the call. Should you wish a “Toll Free” or freephone number, you would need to buy what Microsoft refer to as “Communication Credits” so that your company pays for the incoming call.

You’ll also need to provide a name and description for the requested number, make sure this is meaningful to you. For more information on Communication Credits, see the Microsoft Article “Set up Communication Credits for your organization”. After clicking “Next” you’ll be shown the assigned number and will have 10 minutes to complete the order.

The confirmation screen confirms that the order has been placed and you can finish the process or request additional numbers.


This tutorial has been split into the following posts;

Part 1 – Background and licencing
Part 2 – Resource accounts and auto attendant numbers (this post)
Part 3 – Creating and configurating the auto attendant

Disclaimer: Details are correct at time of publishing.

Part 1 – Creating an auto attendant in Microsoft Teams

Background

Microsoft Teams can be used to create a virtual reception or as it’s known in Teams, an “Auto attendant”, to route incoming calls to people within your business. A good example of this is when calling automated systems such as your bank when you’re asked to “Press 1 for loans, 2 for Mortgages or 3 to speak to someone.” Etc. Using the built-in tools and with the correct licences, Microsoft Teams can be configured in the same way. Over the next few posts, I’m going to show you a simple call flow, what’s needed to setup something similar and then how to configure the reception number and flow for your business. Creating an auto attendant with options is not as simple as it looks and requires some back and forth between the different options. We’re going to setup an example auto attendant covering the following steps over the next few posts;

Assumptions

To complete this setup, the following has been assumed;

  • The user completing the steps has the necessary administration access
  • Microsoft Teams is already in use and deployed in the organization

Virtual User licences

If they don’t already exist in the tenant, you’ll need at least 1 “Microsoft 365 Phone System – Virtual User” licence assigned. These are free licences and will be assigned to the resource account created in part 2.

Obtaining Virtual User licences

From the Microsoft 365 admin centre (https://admin.microsoft.com/) select “Billing” > “Purchase services”. The licence required is considered an add-on and can be found by scrolling to the bottom of the “Purchase services” page and clicking “Add-ons”.

There is no charge for these licences so multiple can be purchased by increasing the number of users (up to 25). We strongly recommend making sure the option of “Automatically assign to all users with no licences” is not ticked before clicking “Check out now”.

The next couple of screens will ask you to confirm the business address and location and present a summary of licences and costs (£0.00). Even though there is no cost, a valid credit card is still required to be registered in the tenant to complete the checkout. Global Administrators of the tenant will be notified by email when the licences are available for assignment. For users to receive calls, they must have an appropriate licence assigned to their account. Some options depending on business size are;

  • Microsoft 365 Phone System (approx. £6.00. user/month)
  • Microsoft 365 Domestic Calling Plan – 120 minutes (approx. £4.50 user/month)
  • Microsoft 365 Domestic Calling Plan – Unlimited minutes (approx. £9.00 user/month)

International calling plans are also available, and these can be purchased and assigned in the same way as the “Microsoft 365 Phone System – Virtual User” product.


This tutorial has been split into the following posts;

Part 1 – Background and licencing (this post)
Part 2 – Resource accounts and auto attendant numbers
Part 3 – Creating and configurating the auto attendant

Disclaimer: Details are correct at time of publishing.

Consent to apps – Are your users giving information away?

Microsoft 365 allows custom and third-party applications using OAUTH 2.0 and OpenID to connect to services such as Exchange Online if given consent to do so.

What does this mean?

When users want to use third-party apps or websites, they can log in with an existing Microsoft 365 work or school account instead of creating another account to remember.  Once this happens, a permission request screen usually appears like the one shown below.

Looking at the example above, if a user clicks “Accept” the app would be able to do the following

  • Read your account profile information.
  • Read basic company information.
  • Read, update, create and delete events in your calendars.
  • Read contacts in your contact folders.

As you can see, there’s information that companies may not want to be shared with third parties, so how can you prevent this?

The easiest way is to turn off “User consent to apps” from “Microsoft 365 admin centre” > “Settings” > “Org settings” > “User consent to apps”.

But what if there are some apps that your company wants users to utilise?  This is where admin consent workflows are useful.

Admin consent requests

The settings for Admin consent can be enabled from the Azure Active Directory Extension in the Azure Portal.  From the left-hand navigation select “Enterprise applications” > “User settings

There are a few settings here so let us take a closer look.

  1. This enables the feature to allow users to submit requests, with this disabled the other settings do not apply.
  2. Add users who are eligible to review and approve consent requests.  At the time of testing this function, individual users only can be selected, not groups.
  3. Enabling this send an email notification to the users selected in setting 2.  Without notifications, approvers will need to check the “Admin consent requests” list.
  4. Enabling reminders will send reminder notifications to the selected approvers before the expiry of the request.
  5. Here you can set how long a request can remain unapproved before expiry. Once expired, users will need to submit additional requests.  This can be set between 1 and 60 days.

Once enabled, the experience for the end user is slightly different.  Instead of the ability to approve the request permissions, the user now sees an “Approval required” prompt where justification can be added before sending for approval.

Once “Request approval” is selected, confirmation is given, and the user is notified of the next steps.

The designated admin receives an email with details of the user, requested app, permissions required, requested date and expiry date.  A direct link to the request in the Azure portal is included.

Clicking the link provides the reviewer with 3 options within the Azure Portal;

Review permissions and consent – This option takes the reviewer to the consent screen for the application allowing a decision to be made based on the permissions required.  This can then be used to grant consent and allow the app to have access.  By granting permission, the application is added to the company’s directory and is available to all users without the need for further consent.  The requestor is then notified via mail and can continue to access the application using their work or school account.

Block – This option will block the request and will send the justification to the requestors.  Additionally, this also block all future requests from other requestors.

Deny – Denies consent for all requestors but justification must be provided, future requests are allowed.

It is worth noting that from testing, if the request is from an account with the Global Administrator role assigned, the request is automatically allowed and does not follow the above workflow.

Disclaimer: Details are correct at time of publishing.