SIP 500 internal server error “from or target user pool or deployment assignment is incompatible with split-domain traffic type”

Problem: User could not transfer a phone call.

Symptom: Bogus error message about split-domain traffic, with almost no articles on the internet or forums to help. Equally bogus error message was “request target is not assigned to a pool or deployment and is not a server GRUU”

Solution: Disable SIP Refer on the SFB Trunk

Explanation: Not all SBC gateways support SIP Refer, but this is the default option when creating a trunk in Skype for Business.

How to prevent Cortana from mining your web browsing history

When Cortana is enabled, information such as your calendar, contacts, speech, handwriting patterns, typing history, location, and browsing history are sent to Microsoft so that Cortana can provide recommendations.

Disabling Cortana is not as easy as you might think. In Windows 10 RTM, you could disable Cortana as shown in the screen shot below.

However, the Windows 10 Anniversary update, this toggle was removed. Home users now have to use the registry to disable Cortana, but business users can use group policy as described (here) and (here).

However, in my case, Cortana continued to send information to Microsoft. Task Manager shows she is still lurking…


You have to admit, that is a little creepy, right?


It turns out that you have to also go to the Bing settings page and clear your personal info and then turn Cortana off there too (Kudos to this Windows Central article for the tip).

Click on Search History Page

Then click the Off button

Cortana is no longer leaking information but as you can see from her CPU counter in Task Manager’s “App History”, she is still alive.

At least she isn’t leaking information though! That is 1 for the Humans and 0.5 for the Robots. Hopefully that doesn’t make her mad and send her AI friend Morgan after me.



Outlook gets “Play” Button for Microsoft Cloud PBX VoiceMail

Recently, while checking my voicemail in Cloud PBX, I noticed that I now have the Play button in Outlook

Now instead of opening up the .MP3 attachment to listen to voicemails, I can simply click the play button.


The ‘play on phone’ button errors out, but the Edit Notes button works.

This feature became enabled when the “Microsoft Exchange Add-in” was added as a COM Add-in inside Outlook


The timestamp on UmOutlookAddin.dll is July 31, 2016


I have not been able to find any announcement about this new capability.

Why PSTN Conferencing Dynamic Conference IDs are so important

Microsoft announced on Friday, August 12th that Dynamic Conference IDs are coming September 1st to Office 365 E5 PSTN Conferencing.

This is an important because it solves a privacy limitation with the current static conference ID’s in service today.

Without dynamic conference IDs, there are no great options to prevent new external callers from interrupting an in-progress meeting (that may be running long). The default ‘out of box’ configuration allows unauthenticated external callers to be admitted into the conference. The option to override this behavior is to change the policy ‘these people don’t have to wait in the lobby’ to “Only me, the meeting organizer.”

However, when that option is selected, the meeting organizer does not receive any pop-up notification to admit PSTN callers who are waiting in the lobby (they just sit there forever). This particular scenario is not directly mentioned in the “Dial-in conferencing known issues” support article. And that is why Dynamic conference IDs will be such a great thing starting September 1st! Note: Any previously scheduled meeting will not automatically have this option, only new scheduled meetings going forward after 9/1 will have this option. Also, any recurring meetings will need to be rescheduled with a new dynamic conference ID to benefit from this privacy feature.

The most useful and controversial changes in Office 365 (Part 2 of 2)

This is part 2. To read part 1, click (here).

In general, Corporate IT Departments want to control the end-user computing experience. Surprises are to be avoided. Pop-ups are anathema to Corporate IT because they result in annoying helpdesk tickets “should I click on this button?” (anyone who has ever served on a helpdesk, God bless them, is rolling their eyes because they know that non-technical people somehow cannot deal with pop-up messages. My favorite: “Should I accept this end-user agreement?” My sarcastic response: “Just click no, we can end this call now and close the ticket.” In all seriousness, surprise pop-up messages that are not communicated first by a trusted source, (“The IT Department”) can cause non-technical end-users to freeze up and panic. Therefore, changes in Office 365 that disrupt the end-user in any way (pop-up messages, etc) are seen as highly controversial (to put it mildly).

Here is a summary of the most controversial changes in Office 365 over the past six months.

The What’s new dialog prompt:

Why is this controversial? First, because this pop-up cannot be suppressed. The ‘What’s New’ dialog box will appear approximately once every 30 days to communicate changes directly to end-users. If the IT Department doesn’t proactively notify end-users about the contents of the pop-up, then this could lead to questions by end-users on whether it is a virus pop-up; many users have been conditioned (wisely) to not click on unfamiliar pop-ups.
Second, because it can advertise features that that IT Department may have disabled, leading to confusion among end-users. For example, if IT has disabled ‘Office 365 Groups’ then do you want a pop-up message to advertise features about it?

The “One-Click Archive” button in Outlook, announced on Feb 25th (here).

Why is this controversial? First, because it generates a pop-up message in Outlook that causes a non-technical person to have to make a decision.

This can lead to helpdesk requests from users seeking advice on what to decide (anyone who disputes this has never worked on a helpdesk before).

Second, because IT has no administrative controls to disable this feature. Why would someone want to disable this? Because if an Enterprise has enabled the Personal Archive feature then this button does not integrate with it, and instead creates a 2nd location to store archived messages. This leads to confusion by the end user on where to look for messages.

OneDrive for iOS App – take data offline -announced May 4th (here)

The OneDrive iOS can now take OneDrive and SharePoint files offline.

Why is this controversial? If you don’t have a Mobile Device Management (MDM) solution such as Intune deployed, how will you wipe the offline files when the employee leaves your organization? – announced August 4th
provides a way for users to Publish Office Documents externally, directly within Word/Excel/PowerPoint, or by browsing to

Why is this controversial? If your organization has limited external sharing (for security reasons) then allows your users to bypass controls setup by IT/Security. IT Departments who have configured URL filtering to block Google Drive, DropBox and other 3rd party file sharing sites may elect to block, since Microsoft currently does not provide any IT controls to disable this feature. For more information click (here).

Second, because your users will be receiving a pop-up notification to advertise this feature. So even if you block via a URL filter, you cannot suppress the what’s new dialog box.

Clutter is replaced with “Focused Inbox” – announced July 26th (here)

Focused Inbox is essentially a way to quickly filter an inbox to show the most important items, similar to what Clutter promised, but with the advantage of not moving it to a separate folder. This is the same feature that has already been available to the Outlook for iOS (if you are using it).

Why is this controversial? Users will receive a pop-up prompt in Outlook to opt-in to Focused Inbox. After they opt-in, Clutter will no longer move items to the clutter folder. Read this help article for more details on the prompts users will see and how to turn Focused Inbox on and off.

IMHO – Focused Inbox is really a much better way to solve the same problem of decluttering an inbox by simply providing a user a ‘view’ of their inbox. IT should communicate the value of Focused Inbox rather than resisting it or scrambling to disable it. Office 365 admins will have mailbox and tenant level control of the feature to stage the rollout in a manner that works best for their organization. However, I feel this is a good feature that should be left on when it rolls out to first-release subscribers in September.

Honorable Mentions:

Modern UI in SharePoint/OneDrive. Did I miss any controversial changes in the past 6 months? If so, please leave a comment.

Have you been caught off-guard by changes in Office 365? Patriot Consulting offers a monthly subscription service to help IT Departments understand and prepare for upcoming changes in Office 365. Watch a brief video about our service (here) or drop us a note at to learn more.

The most useful and controversial changes in Office 365 (Part 1 of 2)

This is the first of a 2-part blog series highlighting the changes in Office 365 in the last 6 months (April 2016 to present).

When it comes to human attitudes toward change, I have found there are three types of people:

  • Those who embrace change
  • Those who resist change
  • Those who are indifferent towards change

This blog post (part 1 of 2) should satisfy those who embrace change, while my second post should intrigue those who resist change. Wait, why not a 3rd post for those who are indifferent towards change? People who are indifferent towards change are probably not reading this blog, as they would have read the title and sighed ‘meh’ before continuing on with their day.

  1. March 18th: Common Attachment Types Filtering for Exchange Online Protection (EOP)

    There is a new configuration setting in EOP feature that provides an easy-to-setup method of filtering out unwanted and potentially malicious attachments by their file types. This feature requires a single click to enable, and can be configured from a list of the file types commonly found to be dangerous. For more information click (here).

  2. April 19th: Office Deployment Tool allows Visio and Project (MSI) to be deployed

    alongside Click-to-Run versions

    This enables IT to deploy the the MSI versions of Visio and Project side-by-side with Office 365 ProPlus click-to-run, as long as they are deployed using the Office Deployment Tool. For more information click (here).

  3. April 14th: OneDrive for Business Next Generation Sync Client (NGSC)

  • The NGSC is 4x faster than the old engine (groove.exe)
  • Includes the highly anticipated ‘Selective Sync’ where users can leave some content in the Cloud and only sync the folders they want
  • Large file limit increased from 2GB to 10GB
  • The sync engine now supports the ‘takeover’ feature, which eliminates the need to re-download all OneDrive content after the NGSC is installed
  • Note: The last feature we are still waiting for is the ability for the NGSC to sync SharePoint document libraries and Office 365 Groups. Until then, Groove.exe must run side-by-side with the NGSC OneDrive.exe

Honorable Mentions:

Flow, Planner, Gigjam, ASM, Bookings, & “Toll Free Numbers in Cloud PBX PSTN Conferencing”

Top 3 reasons I should have adopted Outlook App for iOS a long time ago


1. Send Availability

How often do we get an email like “are you available to meet tomorrow.”  Now, when I reply, I can click a button and select available time slots, and with one more button press, I can quickly send my availability! In this manner, it is actually more efficient than the current Outlook full client!  The closest thing we have to this in the full Outlook  client is the  ‘FindTime’ app in Outlook.



2. Attach Files or Photos while composing email

This is a huge advantage over the native iOS mail client, I still remember when I used an iPhone for the first time and could not find any way to attach a file to an email I was drafting. My friend snickered, “that’s because you have to go to the photo first, then click share, then draft your email.” Hmmm.. okay… I guess but that wasn’t completely obvious to me. So I love the more natural ability to attach a file after I start composing a new email. What I like even more is that it shows me files that have recently been sent to me in email, as well as files I have in my OneDrive (and other storage providers too).


3. Consume RMS protected attachments sent from “RMS sharing app”

One of the main obstacles for adoption of RMS is the lack of support for it on mobile devices. Now, with the Outlook App for iOS, I can open RMS protected content when it is sent from the RMS Sharing App.  What doesn’t work is opening RMS protected email messages although it is apparently supposed to work according to this article (here). Perhaps it is a bug in the latest iOS client since it is listed as being a supported feature.


No Significant Drawbacks

One of the features I liked about the native mail client in iOS is the ability for multiple mail accounts to be added (for example, the ability to quickly check both business and personal email accounts). Happily, this feature works the same in Outlook App for iOS,, and I have not found any other productivity loss.

I have occasionally come across a few instances where the Outlook App for iOS is not detected as a mail client, for example, in Safari it was not one of the default actions when I needed to forward a URL via email. I was able to easily add it to the Safari quick actions, so that wasn’t too difficult. I think there was one other native app that was looking for an account registered as a native account, which I no longer have, so it failed to work. Other than that one drawback, I am very happy with the new productivity enhancements I have gained.

So I have switched from using the native mail client in the iOS to using the Outlook App for iOS and so far I am only wishing I made this switch earlier!

AutoMapping stuck after mailbox migration

After migrating a mailbox to Office 365 Exchange Online, if the mailbox previously had full access permissions prior to the migration, then after the mailbox migration is finished the user may receive lots of authentication prompts. This happens by design since cross-forest permissions are not supported. Mailboxes that require full-access and/or send-as permissions should be migrated together in groups to avoid this issue.

But what happens if someone overlooks this requirement and moves a mailbox without moving the shared mailboxes along with it? This is where it gets very interesting. While it is possible to remove the full-access permission from the on-premises mailbox, that change won’t sync or take any effect and doesn’t solve the issue. Likewise, migrating the mailbox to Office 365 with the permissions removed prior to the shared mailbox migration won’t solve the problem (you might expect the original mailbox to see the newly migrated mailbox and that it no longer has full-access, and that would be enough to remove the AutoMapping feature). However, no, that is not how it works. To remove the auto-mapped shared mailbox, you have to migrate the shared mailbox, add the full access permission, then remove it again. That triggers the delegate’s outlook to remove the shared mailbox from the left navigation in Outlook.

Skype for business Event ID 1047 LS File Transfer Agent

During a deployment at a customer site I ran into a problem with SkypeFB Edge replication.

After adding the Edge to the topology, installing the role on the server and proper certificates, replication was failing with Event ID 1046 and Event ID 1047.

The solution was to add the following registry key:

  1. Open Regedit on the Edge server
  2. Go to HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNEL
  3. Right click and add the DWORD (ClientAuthTrustMode)
  4. Set the value of the DWORD to 2
  5. Restart the server
  6. On the front-end run this command and then wait 2 minutes

Additionally, when working with Microsoft support they also recommended creating these two additional keys:

SendTrustedIssuerList (Value 0) and EnableSessionTicket (Value 2).



There is an interesting troubleshooting article with tracing presented here that could also solve the problem if it was caused by a missing intermediate authority.

And while researching this problem, I came across a very thorough article on this topic that is worth translating into English:

Skype for Business Services won’t start

Immediately after installing Skype for Business Server 2015 (Standard Edition) the front-end services would not start.

Tom Rimala’s blog article that suggested there is a problem when the internal Certificate Authority uses MD5 as the signature signing method.

Also, the Microsoft Certificate Requirements says “The default digest, or hash signing, algorithm is RSA.” (no mention of MD5).

I changed the CA Authority’s certificate from MD5 to SHA1. Here is the registry key to change on the Root CA signing information (we changed these three values). Note: the guidance was to change this on the Root and Subordinate but in our case the Root was also the issuing CA, so there was no subordinate to change in our case.


The next step is to restart the Root CA services. Then issue a new Root Certificate. Then copy the new root CA cert to the Skype for Business front-end, and finally re-issued the Front End Cert and OATH cert. Then the services should start up.

There was a false negative warning about Event ID 32174 “Server startup is being delayed because fabric pool manager has not finished initial placement of users.” This is clearly a bogus error because a Front-End server doesn’t have additional servers to place users into.


There was a clue about the Certificate problem because the System Event log contained a ton of Schannel events such as 36888, “A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 40. The Windows SChannel error state is 1205.” And Event ID 36874 “An TLS 1.2 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.” I am adding these details in the event that a search engine might index these errors to point people to this fix.