Microsoft 365 and Collaboration

Exchange Online Management

Microsoft Entra can be used to manage Exchange online mailboxes, distribution lists, and mail-enabled security groups. The Microsoft Entra ID connector uses Exchange Online PowerShell Module through IQService to support this feature.

Exchange Online Management supports the following operations:

Aggregation of Exchange Online Mailbox attributes for users
Aggregation of Shared Mailbox as an entitlement for users
Aggregation of Exchange Online attributes for groups
Modification of Exchange Online Mailbox attributes
Adding and Removing Shared Mailboxes from users
Adding and Removing Exchange Distribution Lists and Mail-Enabled Security groups from users

Note

Delta Aggregation does not capture changes in Exchange Online Attributes and Shared Mailbox assignments.

Objects/Attributes	Aggregation	Modification	Add/Remove User
Exchange Online Mailbox attributes for users	Yes	Yes	N/A
Shared Mailbox as an entitlement for users		N/A	Yes
Exchange Online attributes for groups		N/A	N/A
Distribution List		N/A	Yes
Mail-Enabled Security Group		N/A	Yes

Prerequisites

The following are required host values by the IQService to interact with the managed service, whitelist/allow the URLs from the IQService machine:

Basic Authentication

Important

Basic authentication in Exchange Online is deprecated by Microsoft. For more information, refer to deprecation of basic authentication in Exchange Online in Microsoft documentation.
It is recommended to utilize Certificate Based Authentication for Exchange Online management.

Configure IQService
Install Exchange Online PowerShell Module: EXO V3 (version 3.0.0 or later) on the same IQService machine.
Create a user in Microsoft Entra ID with the Exchange Administrator role.
Select Manage Exchange Online on Application Configuration page.
Provide the username and password of the user you created.

Note

The configured IQService user in the source XML must match the logged-on user for that IQService on the Windows server where the IQService is installed. If the IQService user is not configured, use IQServices as the local user context.(Path: Services> IQService-Instance >Log On As)

Note

Due to a limitation on PowerShell sessions, SailPoint recommends using separate IQService instances and a separate exchange admin user for different Microsoft Entra ID applications, which are defined to manage exchange online.

Note

The connector uses PowerShell sessions to manage Exchange Online Mailboxes. Due to restrictions on the number of concurrent PowerShell sessions allowed by Microsoft, there may be a delay or occasional failures when the connector processes Exchange Online requests.

Certificate Based Authentication

The following additional API permission needs to be added to the already registered Microsoft Entra ID Enterprise Application. Refer to the Prerequisites section regarding application registration and API permissions, if necessary.
- Permission Exchange.ManageAsApp, for Office 365 Exchange Online
- The steps to assign API permissions to an application are listed here: Assign API permissions to the application.
Assign the following roles to the application:
- Exchange Administrator
- The steps to assign roles to an application are listed here: Assign Microsoft Entra roles to the application.
To ensure modern authentication:
- A certificate key-pair needs to be generated for the IQService machine. This will be used by the Exchange PowerShell module to connect to the Exchange Online.
- The certificate must be uploaded to the registered Microsoft Entra ID Enterprise Application under Certificates and Secrets.
The steps to generate a self-signed certificate and attach it to the Microsoft Entra ID application are listed here:
- Generate a self-signed certificate
- Attach the certificate to the Microsoft Entra ID application
Use Exchange Online PowerShell Module: EXO V3 (version 3.0.0 or later).

Schema Configurations

You must add Exchange attributes that you want to aggregate to the account or group scheme with the prefix EXO_.

For example, to aggregate EmailAddresses attribute, add it to the schema as follows:

Name: EXO_EmailAddresses
Type: String
Property: Multivalued
To aggregate shared mailbox attributes as an Entitlement, add sharedMailbox as an account attribute.
Example Name: sharedMailbox
Type: String
Property: Multivalued, Entitlement, Managed

Aggregate Exchange Online Groups

By default, the Microsoft Entra ID connector aggregates Mail-Enabled Security groups. To aggregate Distribution List groups, on the Aggregation Settings page, enable the Aggregate All Groups configuration parameter.

Note

Aggregation of Distribution List group with basic group details does not need Exchange Online IQService configuration.

Add/Remove Exchange Distribution Groups from Users

When adding a user to, or removing a user from, a Mail-Enabled Security group, the user configured in the Manage Exchange Online configuration must be the owner of the group. The Distribution does not have the same restriction, but SailPoint recommends that the user in the Manage Exchange Online configuration is the owner of the group.

Note

When the Exchange Online Authentication Type is set to certificate-based authentication, BypassSecurityGroupManagerCheck entry gets added by default. If you don't want to use BypassSecurityGroupManagerCheck, add enableByPassSecurityManagerCheck entry to the source XML with its value set to false.

Provisioning Policy Changes

To update the Exchange Mailbox attribute value, the attribute must be added to provisioning policy with the prefix EXO_.

For example, to update the Alias attribute, it must be added in provisioning policy as follows:

Name: EXO_EmailAddresses
Type: String
Type Setting: Multivalued: true, Review Required: true

Note

It is important to add with proper attribute type and property, which meets exchange attribute definition for successful update operation.
Attributes to be added in provisioning policy must be present in account schema.

Shared Mailbox As Entitlement

Note

sharedMailbox is fetched only during account aggregation when the promote managed attribute is true by default in SailPoint. All sharedMailbox that are assigned to users are aggregated during account aggregation as entitlements. Unassigned sharedMailbox on the Microsoft side are not aggregated. There is no support of entitlement aggregation for sharedMailbox.

An Exchange user can be a member of a Shared Mailbox. Along with membership, the user obtains permission on the mailbox. This permission has to be selected while adding the user to the shared mailbox. The following permissions are categorized as Recipient and Mailbox:

Recipient: SendAs
Mailbox: ChangeOwner, ChangePermission, DeleteItem, ExternalAccount, FullAccess, ReadPermission

In order to provide flexibility to select the permission to be assigned, mailbox entitlements are created one per permission per mailbox as shown in the following example:

User Mark Taylor has SendAs, FullAccess and ReadPermission permissions on shared mailbox called O365Support. After account aggregation following entitlements would be created:

O365Support: SendAs

O365Support: FullAccess

O365Support: ReadPermission

Microsoft Teams

Microsoft Teams, also referred to simply as Teams, is a unified communication and collaboration platform that combines persistent workplace chat, video meetings, file storage (including collaboration on files), and application integration.

Teams are built on the top Microsoft 365 groups. The Microsoft 365 group forms the directory object representing Teams. All identity and access controls for Teams are performed on the Microsoft 365 group. Because the Microsoft Entra ID connector deals with directory objects, Microsoft Teams are represented as part of Microsoft 365 Groups.

As Microsoft Entra ID connector deals with directory objects, Microsoft Teams are represented as Microsoft 365 Groups.

The Manage Office 365 Groups checkbox must be selected as it is aggregated as Microsoft 365 Group.

The following operations are supported:

Add or Remove Owners and Members

Attribute Name	Action	Group Schema	Create Group Policy
teamsEnabled	Distinguish Teams group	Type: Boolean	NA
teamsEnabled	Enabling Teams creation	NA	Type: Boolean Review Required: True
teamsEnabled	Enabling Teams creation for existing Microsoft Office 365 Groups	NA	Type: Boolean Review Required: True
Owners	NA	Property: Multi-Valued Data Type: string Description: Owners of the group	Read-Only: False

Channel Management

Microsoft Teams, also referred to as Teams, is a unified communication and collaboration platform that combines persistent workplace chat, video meetings, file storage (including collaboration on files), and application integration.

Channels are dedicated sections within a team to keep conversations organized as per organization requirements.

Basic criteria for any user to be able to be part of the channel is to be part of the team. If the user is not part of the team, then they cannot be added to the channel. Access to the channel varies based on the type of channel:

Standard Channel: By default, any user who is member of the Team gets membership to the standard channel.
Private Channel: Owner/ Admin of the channel needs to add the team member to the channel. By default, the channel is not accessible to anyone other than the owner/ admin.

Addition of a user to the team gives access to the standard channel, and removal of a user from the team leads to automatic removal from all channels including private channels to which user has access to.

This feature provides support for the following operations:

Aggregation of channels as separate group object.
Aggregation of user membership to channels.
Add or remove users from private channels.

Note

Before enabling Teams Governance, ensure that Manage Microsoft 365 Groups is enabled.
Enabling the Teams Governance feature can have impact on aggregation performance due to API limitations to fetch channel memberships.

Administrator Permissions

Permission	Permission Type	Purpose
Channel.Create	Application	Create Channel
Channel.Delete.All	Application	Delete Channel
Channel.ReadBasic.All	Application	Aggregate Channels
ChannelMember.ReadWrite.All	Application	Add or Remove Channel Members
ChannelMember.ReadWrite.All	Delegated	Add or Remove Channel Members

Supported Schema Attributes

To manage the channel management objects, ensure that the attributes present in Channel Attributes are present in the group schema.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.