<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Hi,<br>
<br>
Yes, exactly the same thing can be done. Our AD connector supports
powershell scripts. And you can also have a custom task. Either
use bulk task with a script action. Or just create a completely
custom TaskHandler in Java (e.g. using maven overlay).<br>
<br>
However, I think midPoint can be much smarter than OIM here. Is
there a way how to livesync or reconcile that O365 instance? Maybe
you can livesync, link the account, then use outbound mapping or
provisioning scripts to provision the license.<br>
<br>
<pre class="moz-signature" cols="72">--
Radovan Semancik
Software Architect
evolveum.com</pre>
<br>
<br>
On 06/13/2018 10:12 PM, Devin Rosenbauer wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CABiXpeRz=asqgRU2Ke3pZz_CWbZ6zYr2HUU_CLDRPjcvDOb_zA@mail.gmail.com">
<div dir="ltr">
<div>Good afternoon,</div>
<div><br>
</div>
<div>I'm in the training with Ivan and he suggested I sent this
off to the mailing list. The situation, which has come up
several times in my corporate Oracle IDM projects, is
Microsoft's Exchange <a
href="https://technet.microsoft.com/en-us/library/jj200581%28v=exchg.150%29.aspx"
moz-do-not-send="true">hybrid installation mode</a>.<br>
</div>
<div><br>
</div>
<div>An account is created in local Active Directory and flagged
as a remote mail user. This is typically done with PowerShell.
A scheduled Microsoft process runs on the domain controller
(every 30 minutes by default) that creates or updates an Azure
AD account and O365 mailbox for remote mail users in the
cloud. This process is called DirSync.</div>
<div><br>
</div>
<div><i>After</i> DirSync runs, we need to provision a license
for the user in O365. This is done either via the Graph REST
API or via another set of PowerShell commands. The license
setup cannot be run before DirSync because the user doesn't
exist in O365 yet.<br>
</div>
<div><br>
</div>
<div>Here's how I've resolved this in OIM: After the AD
PowerShell commands, I set a flag on the <i>user</i> in OIM
to mark them as needing a license. A custom scheduled job
(just some Java code) in OIM attempts to provision the license
for the each user with the flag set. If the license is
successfully added, the user is un-flagged. If the license is
NOT successfully added, the user retains the flag and we try
again.</div>
<div><br>
</div>
<div>Could something like this be done in Midpoint?</div>
<div><br>
</div>
<div><br>
-- <br>
<div class="gmail_signature" data-smartmail="gmail_signature">
<div dir="ltr">Devin Rosenbauer<br>
Principal Consultant<br>
Identity Works LLC<br>
+1 585 210 3201<br>
</div>
</div>
</div>
</div>
<!--'"--><br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
midPoint mailing list
<a class="moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a>
<a class="moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">
</pre>
</body>
</html>