Finding users already using New Outlook

The New Outlook for Windows is coming! It looks way better than the existing Outlook and the Windows Mail app, though not as good as the New Outlook for macOS. πŸ™ƒ

It is possible to disable the toggle that let’s users switch to it – via a registry key. Or possible to leave the toggle as is but disable the New Outlook experience itself – via Exchange Online PowerShell. Or do both.

But, if you disable it once someone is already using New Outlook that’s going to be a problem. They will be unable to use Outlook at all until they create a new profile. So, we need a way of identifying users already using New Outlook and either let them know before disabling it for all; or exclude these users while you go ahead and disable it for everyone else.

But how do you find such users? I couldn’t find any obvious way of getting this info. There’s no property set anywhere when someone uses this client. Nothing in Exchange Online either.

I took a look at the Azure AD sign in logs to see if some new client type comes up, but nope. When I use Outlook (new or old) the Application display name is “Office365 Shell WCSS-Client” but there’s no way of identifying the client. Interestingly, the type of the application appears as Browser – “Edge 115.0.1901”. I went back in time to previous sign-ins and the version was “Edge 114.0.1823” – since 115 was released yesterday that explains the version bump.

Ok, so no way of distinguishing between a regular browser user access OWA vs someone using New Outlook.

Then I noticed the User Agent string in the logs. Typically it is “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ Safari/537.36 Edg/115.0.1901.183” or “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ Safari/537.36 Edg/114.0.1823.8” or “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Teams/ Chrome/102.0.5005.197 Electron/19.1.8 Safari/537.36” and so on…. there are variants for MacOS too.

But when using New Outlook the User Agent is “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ Safari/537.36 Edg/115.0.1901.183 OneOutlook/1.2023.712.100“. Ah, gold! One Outlook is the name of this New Outlook.

Is there a way to query Graph on User Agent? Nope, I couldn’t find this property in the output of Get-MgAuditLogSignIn. But I switched to the beta endpoint and there it is! Awesome.

Armed with this info, I can use the following to get me all users who used New Outlook in the past 90 days.

This basically finds all successful logins (status/errorCode eq 0) of type browser (clientAppUsed eq 'Browser') and whose User Agent contains the word OneOutlook (contains(UserAgent,'OneOutlook')). Further I limit to entries created in the last 90 days (CreatedDateTime ge $startDate).

And that’s it! Now I have a list. I could have skipped the sorting and stuff, that’s just a leftover from previous versions of the code (I use it for other purposes too).