The New Outlook for Windows is coming! It looks way better than the existing Outlook and the Windows Mail app, though not as good as the New Outlook for macOS. 🙃
It is possible to disable the toggle that let’s users switch to it – via a registry key. Or possible to leave the toggle as is but disable the New Outlook experience itself – via Exchange Online PowerShell. Or do both.
But, if you disable it once someone is already using New Outlook that’s going to be a problem. They will be unable to use Outlook at all until they create a new profile. So, we need a way of identifying users already using New Outlook and either let them know before disabling it for all; or exclude these users while you go ahead and disable it for everyone else.
But how do you find such users? I couldn’t find any obvious way of getting this info. There’s no property set anywhere when someone uses this client. Nothing in Exchange Online either.
I took a look at the Azure AD sign in logs to see if some new client type comes up, but nope. When I use Outlook (new or old) the Application display name is “Office365 Shell WCSS-Client” but there’s no way of identifying the client. Interestingly, the type of the application appears as Browser – “Edge 115.0.1901”. I went back in time to previous sign-ins and the version was “Edge 114.0.1823” – since 115 was released yesterday that explains the version bump.
Ok, so no way of distinguishing between a regular browser user access OWA vs someone using New Outlook.
Then I noticed the User Agent string in the logs. Typically it is “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.183” or “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.8” or “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Teams/1.6.00.20074 Chrome/102.0.5005.197 Electron/19.1.8 Safari/537.36” and so on…. there are variants for MacOS too.
But when using New Outlook the User Agent is “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.183 OneOutlook/1.2023.712.100“. Ah, gold! One Outlook is the name of this New Outlook.
Is there a way to query Graph on User Agent? Nope, I couldn’t find this property in the output of Get-MgAuditLogSignIn. But I switched to the beta endpoint and there it is! Awesome.
|
1 2 |
UserAgent : Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Teams/1.6.00.20074 Chrome/102.0.5005.197 Electron/19.1.8 Safari/537.36 |
Armed with this info, I can use the following to get me all users who used New Outlook in the past 90 days.
|
1 2 3 4 |
$startDate = Get-Date (Get-Date).AddDays(-90) -Format 'yyyy-MM-dd' Get-MgBetaAuditLogSignIn -All -Filter "clientAppUsed eq 'Browser' and status/errorCode eq 0 and contains(UserAgent,'OneOutlook') and CreatedDateTime ge $startDate" | Sort-Object CreatedDateTime -Descending | Select-Object -Property UserPrincipalName -Unique |
This basically finds all successful logins (status/errorCode eq 0) of type browser (clientAppUsed eq 'Browser') and whose User Agent contains the word OneOutlook (contains(UserAgent,'OneOutlook')). Further I limit to entries created in the last 90 days (CreatedDateTime ge $startDate).
And that’s it! Now I have a list. I could have skipped the sorting and stuff, that’s just a leftover from previous versions of the code (I use it for other purposes too).