AD Connector Error: Enable-Mailbox disallowed for Migrated Users during Account Disable

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Hello Community,

I am encountering an issue with our Active Directory Disable Provisioning Plan in a hybrid Exchange environment.

The Error

When disabling migrated users (msExchRecipientTypeDetails = 2147483648), the plan fails instantly with this exception:

Disable | [Failed to update attribute msExchHideFromAddressLists Error - Error while executing command - Enable-mailbox : Enable-Mailbox on this mail user is disallowed because the mailbox has been migrated., Failed to update attribute mailNickname Error - Error while executing command - Enable-mailbox : Enable-Mailbox on this mail user is disallowed because the mailbox has been migrated.]

In our disable plan we sets mailNickname = "" and msExchHideFromAddressLists = true.

What is the best practice to handle this split hybrid scenario inside the lifecycle plan?

2

Can you try below steps To fix this, intercept the plan using an AD Before Provisioning Rule to prevent the connector from triggering legacy on-premises Exchange cmdlets.

  1. Check the attribute: Inspect msExchRecipientTypeDetails for the migrated value (2147483648).
  2. Remove mailNickname: Use account.remove(account.getAttributeRequest("mailNickname")) so it does not clear.
  3. Handle hiding: Either remove msExchHideFromAddressLists from the plan or format it purely as a standard LDAP write.
  4. Use IQService: Offload the address book hiding for cloud users to a PowerShell After-Modify script.
  5. Run Cloud Cmdlet: In the script, use Set-Mailbox -HiddenFromAddressListsEnabled $true directly in Exchange Online.

Check this code might be help

import sailpoint.object.ProvisioningPlan;
import sailpoint.object.ProvisioningPlan.AccountRequest;
import sailpoint.object.ProvisioningPlan.AttributeRequest;
import java.util.List;

if (plan != null) {
List accounts = plan.getAccountRequests();
if (accounts != null) {
for (AccountRequest account : accounts) {
// Target only Active Directory disable actions
if (account.getOperation() != null && account.getOperation().equals(AccountRequest.Operation.Modify)) {

            // Get the user's current recipient type detail from the link/source
            String nativeIdentity = account.getNativeIdentity();
            // (Optional: fetch from the identity's AD link schema if not cached)
            String recipientType = (String) context.getUniqueObject(Link.class, "nativeIdentity", nativeIdentity).getAttribute("msExchRecipientTypeDetails");

            // Check if user is fully migrated (2147483648)
            if ("2147483648".equals(recipientType)) {
                
                // 1. Remove the mailNickname clear instruction entirely
                account.remove(account.getAttributeRequest("mailNickname"));
                
                // 2. Safely route the address list hide to avoid Enable-Mailbox triggers
                AttributeRequest hideReq = account.getAttributeRequest("msExchHideFromAddressLists");
                if (hideReq != null) {
                    // Option A: Use an after-script/native AD LDAP path instead, 
                    // or prefix with 'Exch_' if using specific custom provisioning styles.
                    // Best practice for migrated users is often managing this in Entra ID/Exchange Online directly,
                    // or renaming the request to write purely to the AD LDAP attribute without Exchange extensions.
                }
            }
        }
    }
}

}

3

@lojainahmed - looks like when you’re setting mailNickName = "", it is calling the Enable-mailbox command automatically. Can you please explain the requirement here as to why you need to clear the mailNickName?

4

It worked when I removed the 2 attributes for the migrated users in the before prov rule
Thanks!