Hi All I’m implementing a Hybrid Exchange + SailPoint ISC setup and need to orchestrate the following workflow: Create user in on-prem Active Directory via SailPoint ISC (AD birthright). Wait for AD Connect to sync the user to Entra ID (my sync interval is ~30 minutes). Enable remote mailb…

[image] Arshad: Thanks in advance for any guidance or examples you can share! Sharing my approach in case it’s helpful to others in the community. My solution involves two PowerShell scripts: The first script generates a CSV file containing Active Directory records that need to be processe…

Hi @Arshad there is no need to delay the enable-remotemailbox PS. I, personally, would use an on-prem sync-ed group for the license assignment as well.

Hey Arshad, We have similar setup, We are using Before Modify rule in a Role to trigger the enable remote mailbox. We created a dummy group called Enable remote mailbox, with assignment criteria to have an AD account and the 0365 Group license group.

[image] j_place: I, personally, would use an on-prem sync-ed group for the license assignment @j_place Thanks for your response. Could you please clarify how the Enable-RemoteMailbox script would be executed in this scenario? From what I understand, you’re suggesting that an on-prem AD group…

Use an after create rule on the AD connector to run the enable-remoteMailbox PS cmd. This adds the attributes to the AD object, which when sync-ed to Entra tell Exchange Online what kind of mailbox to create (a remote user mailbox in this case). Yes an on-prem synced group for each Entra license gr…

@j_place I’m not an Exchange expert, so please correct me if I’m wrong here, but in a Hybrid Exchange setup, isn’t it important to make sure the AD account is fully synced and visible to the on-prem Exchange server before running certain commands, like Enable-RemoteMailbox? Also, just wondering, do…

Hi @Arshad enable-remoteMailbox doesn’t actually do anything Exchange related; on-prem exchange only talks to exchange online though AD attributes and relies on AADC or Entra connect to pass the attributes on the user object. So, no you don’t need to wait for the object to be synchronised before run…

Agreed with all the points what @j_place mentioned. If you still want to execute the enableMailbox command after the EntraID sync-up, below might be a work around. Create a dummy group in AD. Create a role with the criteria to check the account existence in Azure along with other active account cr…

Hi @suresh4iam With all due respect, if you agree with my points, then surely you must agree this is pointless over-engineering? However, you are right, if @Arshad wants to do this, then that is up to him, and I will step away from the conversation.

Hello @Arshad , You can use the following solution. Create user in on-prem Active Directory via SailPoint ISC (AD birthright). –> Using the AD BirthRight Role and Access Profile, provision the User to On-Prem AD source. No need to increase vthe timeout to 600 seconds but make sure that provisioni…

I assume you’re not using the same CSV file for all requests as IQService has no problem running multiple instances of the AfterCreate Powershell script at the same time, which causes issues where one script would lock the file when another script wants to write to it, causing data loss. This is why…

Automating Enable Remote Mailbox and Entra License assignment in hybrid Exchange with ~30 min AD-to-Entra sync

Identity Security Cloud (ISC) ISC Discussion and Questions

j_place (Jeremy Place) September 18, 2025, 8:15am 13

For anyone reading this in the future:

Although the OP asks how to delay the running of enable-remotemailbox and this has been answered - THERE IS NO NEED to delay the running of enable-remotemailbox. See Exchange Mailbox Provisioning - #5 by j_place

Topic		Replies	Views
Exchange Mailbox Provisioning ISC Discussion and Questions identity-security-cloud , provisioning	10	1147	September 7, 2025
Hybrid exchange email provisioning/enabling policy ISC Discussion and Questions identity-security-cloud , provisioning	23	169	April 8, 2026
Best Practices for Enabling a Remote Mailbox for Existing AD Accounts ISC Discussion and Questions identity-security-cloud	6	258	February 7, 2026
Remote Mailbox provisioning in ISC ISC Discussion and Questions identity-security-cloud , provisioning , connectors	4	247	August 2, 2025
ISC - Creating Mailbox on Exchange Online (Entra ID) after Account Creation ISC Discussion and Questions rules , identity-security-cloud , provisioning , connectors	13	943	June 27, 2025

Automating Enable Remote Mailbox and Entra License assignment in hybrid Exchange with ~30 min AD-to-Entra sync

Related topics