<div dir="ltr"><div>Thanks for the responses, everyone!<br></div><div><br></div><div>That's a good idea, to use the LiveSync against O365. The trouble is that as far as the Exchange system is concerned, the cloud and on-premises accounts are one single account in two places. That may not be the best way to manage those in an identity manager though.</div><div><br></div><div>I do like the idea of using the group-based license sync. However, in practice I've found that feature to be still quite buggy. It's a very new feature. Licenses are sometimes not assigned when the group synchronization happens. There can be a considerable delay before Microsoft reprocesses and there's no clear indication that it's finished.</div><div><br></div><div>There's a second use case, though, for which the group-based sync won't work. Some clients require that we also set some other attributes on the Mailbox (in the cloud, after dirsync), such as retention policy. You can set up defaults for these in O365, but they prefer different settings for different users. They're also assigning access rights on the mailbox to a data-loss prevention type system. I don't know if there's a way to do this in Azure directly, but that's not been the case at our other installations.<br><br></div><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jun 14, 2018 at 2:33 AM, Radovan Semancik <span dir="ltr"><<a href="mailto:radovan.semancik@evolveum.com" target="_blank">radovan.semancik@evolveum.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
<div class="m_8647935042993746615moz-cite-prefix">Hi,<br>
<br>
Yes, exactly the same thing can be done. Our AD connector supports
powershell scripts. And you can also have a custom task. Either
use bulk task with a script action. Or just create a completely
custom TaskHandler in Java (e.g. using maven overlay).<br>
<br>
However, I think midPoint can be much smarter than OIM here. Is
there a way how to livesync or reconcile that O365 instance? Maybe
you can livesync, link the account, then use outbound mapping or
provisioning scripts to provision the license.<span class="HOEnZb"><font color="#888888"><br>
<br>
<pre class="m_8647935042993746615moz-signature" cols="72">--
Radovan Semancik
Software Architect
<a href="http://evolveum.com" target="_blank">evolveum.com</a></pre></font></span><div><div class="h5">
<br>
<br>
On 06/13/2018 10:12 PM, Devin Rosenbauer wrote:<br>
</div></div></div>
<blockquote type="cite"><div><div class="h5">
<div dir="ltr">
<div>Good afternoon,</div>
<div><br>
</div>
<div>I'm in the training with Ivan and he suggested I sent this
off to the mailing list. The situation, which has come up
several times in my corporate Oracle IDM projects, is
Microsoft's Exchange <a href="https://technet.microsoft.com/en-us/library/jj200581%28v=exchg.150%29.aspx" target="_blank">hybrid installation mode</a>.<br>
</div>
<div><br>
</div>
<div>An account is created in local Active Directory and flagged
as a remote mail user. This is typically done with PowerShell.
A scheduled Microsoft process runs on the domain controller
(every 30 minutes by default) that creates or updates an Azure
AD account and O365 mailbox for remote mail users in the
cloud. This process is called DirSync.</div>
<div><br>
</div>
<div><i>After</i> DirSync runs, we need to provision a license
for the user in O365. This is done either via the Graph REST
API or via another set of PowerShell commands. The license
setup cannot be run before DirSync because the user doesn't
exist in O365 yet.<br>
</div>
<div><br>
</div>
<div>Here's how I've resolved this in OIM: After the AD
PowerShell commands, I set a flag on the <i>user</i> in OIM
to mark them as needing a license. A custom scheduled job
(just some Java code) in OIM attempts to provision the license
for the each user with the flag set. If the license is
successfully added, the user is un-flagged. If the license is
NOT successfully added, the user retains the flag and we try
again.</div>
<div><br>
</div>
<div>Could something like this be done in Midpoint?</div>
<div><br>
</div>
<div><br>
-- <br>
<div class="m_8647935042993746615gmail_signature" data-smartmail="gmail_signature">
<div dir="ltr">Devin Rosenbauer<br>
Principal Consultant<br>
Identity Works LLC<br>
+1 585 210 3201<br>
</div>
</div>
</div>
</div>
<br>
<fieldset class="m_8647935042993746615mimeAttachmentHeader"></fieldset>
<br>
</div></div><span class=""><pre>______________________________<wbr>_________________
midPoint mailing list
<a class="m_8647935042993746615moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a>
<a class="m_8647935042993746615moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank">http://lists.evolveum.com/<wbr>mailman/listinfo/midpoint</a>
</pre>
</span></blockquote>
<br>
<br>
<pre class="m_8647935042993746615moz-signature" cols="72"></pre>
</div>
<br>______________________________<wbr>_________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/<wbr>mailman/listinfo/midpoint</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">Devin Rosenbauer<br>Principal Consultant<br>Identity Works LLC<br>+1 585 210 3201<br></div></div>
</div>