SharePoint Tenant Rename

[anthony-kantola-gb]

I have been trying to run ScubaGear against a tenant that I administer and getting errors when authenticating to SharePoint Online. I saw the other issue reported regarding using unattended credentials. That does allow authentication to succeed, but it still reports an error. We have renamed the SharePoint domain name in this tenant. The tool reports the following error:

WARNING: Error running Get-PnPTenant. The remote name could not be resolved: '[redacted]-admin.sharepoint.com'
WARNING: Error running Get-PnPTenantSite. The remote name could not be resolved: '[redacted]-admin.sharepoint.com'

And the resulting report shows the following:

Control ID Requirement Result Criticality Details
MS.SHAREPOINT.1.1v1 External sharing for SharePoint SHALL be limited to Existing guests or Only people in your organization. Error - Test results missing - Report issue on GitHub

It is referring to "[redacted]-admin.sharepoint.com" however the URL for our SharePoint admin port is "[redacted]-admin.sharepoint.com".

[anthony-kantola-gb]

To add some additional details, [redacted].onmicrosoft.com is the fallback domain for this tenant. The primary domain and name of the tenant are both [redacted]. I am running it with the following command line parameters:

Invoke-SCuBA -ProductNames * -CertificateThumbprint [removed for security] -AppID [removed for security] -Organization [redacted]

[schrolla]

Thank you for your report.
You present an interesting case here with the tenant rename. ScubaGear uses Get-MgBetaOrganization to find the initial domain name of the tenant and uses that to construct the admin URL. So I can see how the rename results in this issue.
If you would, could you run the following commands and share the output. You should be able to run these after running Invoke-Scuba -p sharepoint which will connect to your tenant to allow the connections to succeed.

$(Get-MgBetaOrganization).VerifiedDomains

and

Get-MgBetaDomain | FT Id,IsDefault,IsInitial,IsVerified

Since this does report domain information, if you aren't comfortable sharing the results, no worries. Or feel free to obfuscate, redact, or remove anything you like. But it will help us understand how the rename impacts the values here, and how we might detect such a condition.

As for getting it to work, the trouble (assuming v1.5.0) is on line 147 in Connection.psm1 where it calculate the domain prefix. You might add the following as a workaround for your specific situation after line 146.

                       if($InitialDomainPrefix -eq '<original_tenant_shortname>') {
                           $InitialDomainPrefix = '<current_admin_tenant_shortname>'
                       }

If you change that, start a new PowerShell session and try running ScubaGear again, that should make sure it uses the correct admin URL and not impact running in your other tenant either. If you try it, let me know if the workaround works for you.

[anthony-kantola-gb]

Here is the requested output. Please let me know after you've captured the details so I can remove/obfuscate the post. Thanks for the workaround. I'll try it.

`(Get-MgBetaOrganization).VerifiedDomains

Capabilities IsDefault IsInitial Name Type

---

Email, OfficeCommunicationsOnline, Intune True False [redacted].com Managed
Email, OfficeCommunicationsOnline, MoeraDomain False False [redacted].onmicrosoft.com Managed
Email, OfficeCommunicationsOnline, MoeraDomain False False [redacted].onmicrosoft.com Managed
Email, OfficeCommunicationsOnline, MoeraDomain False True [redacted].onmicrosoft.com Managed
Email, OfficeCommunicationsOnline, Intune False False [redacted].com Managed`

`Get-MgBetaDomain | FT Id,IsDefault,IsInitial,IsVerified

Id IsDefault IsInitial IsVerified

---

[redacted].com True False True
[redacted].onmicrosoft.com False False True
[redacted].onmicrosoft.com False False True
[redacted].onmicrosoft.com False True True
[redacted].com False False True`

[schrolla]

Here is the requested output. Please let me know after you've captured the details

Details have been captured. Thank you.

[anthony-kantola-gb]

I tried executing with the If clause in place to substitute the correct domain prefix. Now I get the error shown below. I do see output for SharePoint Online in the report now though.

WARNING: Error running Get-PnPTenantSite: Attempted to perform an unauthorized operation.
at TryCommand, C:\Program Files\WindowsPowerShell\Modules\ScubaGear\1.5.0\Modules\Providers\ProviderHelpers\CommandTracker.psm1: line 23
at Export-SharePointProvider, C:\Program Files\WindowsPowerShell\Modules\ScubaGear\1.5.0\Modules\Providers\ExportSharePointProvider.psm1: line 39
at Invoke-ProviderList, C:\Program Files\WindowsPowerShell\Modules\ScubaGear\1.5.0\Modules\Orchestrator.psm1: line 629
at Invoke-SCuBA, C:\Program Files\WindowsPowerShell\Modules\ScubaGear\1.5.0\Modules\Orchestrator.psm1: line 403
at , : line 1

[schrolla]

I tried executing with the If clause in place to substitute the correct domain prefix. Now I get the error shown below. I do see output for SharePoint Online in the report now though.

WARNING: Error running Get-PnPTenantSite: Attempted to perform an unauthorized operation. at TryCommand, C:\Program Files\WindowsPowerShell\Modules\ScubaGear\1.5.0\Modules\Providers\ProviderHelpers\CommandTracker.psm1: line 23 at Export-SharePointProvider, C:\Program Files\WindowsPowerShell\Modules\ScubaGear\1.5.0\Modules\Providers\ExportSharePointProvider.psm1: line 39 at Invoke-ProviderList, C:\Program Files\WindowsPowerShell\Modules\ScubaGear\1.5.0\Modules\Orchestrator.psm1: line 629 at Invoke-SCuBA, C:\Program Files\WindowsPowerShell\Modules\ScubaGear\1.5.0\Modules\Orchestrator.psm1: line 403 at , : line 1

Ah, yes so the InitialDomainPrefix is used to construct both the admin URL and the Site Identity URL. The latter rebuilds the URL in a different place in the code, so you can add the same conditional as before, but add it after line 28 in ExportSharePointProvider.psm1.

[schrolla]

Also, if you are comfortable using ScubaGear from a branch, I created a branch that calculates the admin URL using a different method that should prevent the issue when the tenant has been renamed.

The branch is at:
https://github.com/cisagov/ScubaGear/tree/1605-sharepoint-tenant-rename
If you download a ZIP of that branch from here, and expand and Import it using the ScubaGear download from GitHub instructions then you should be able to see if this works for all your tenants.

Note two changes that go with this.

1. You will want to re-run Initialize-ScubaGear after import as this adds another module dependency.
2. If running non-interactively using a service principal, you will need to add the Microsoft.Graph.Sites.Read.All permission to the service principal for it to read the root site web URL property.

If you do decided to try this, let me know if it addresses your issue or if it results in similar or other undesirable behavior.