Azure Active DIrectory Pulls in Shared Mailboxes as Guids

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Which IIQ version are you inquiring about?

8.5

Share all details about your problem, including any error messages you may have received.

*When aggregating Exchange Online information using the Entra Connector (Azure Active Directory), shared mailbox rights get displayed on the account as a GUID. Most often we create shared mailboxes using New-RemoteMailbox on Exchange Server.

This is problematic in access reviews for obvious reasons, is there a way to set these shared Mailbox entitlements as a UserPrincipalName or PrimarySMTPAddress of the Mailbox*

2

Hi @mrioux

Can you please share the screenshot of the Schema for all the types you have configured i.e. Accounts, Groups.

3

image
image1333×717 67.3 KB

image
image835×897 95.9 KB

image
image1323×908 45.3 KB

image
image1321×462 20.3 KB

image
image1321×507 24.5 KB

image
image1323×803 57.3 KB

4

@mrioux Are you also running the Group Aggregation for Shared Mailbox Rights?

5

Here is our group aggregation task. I don’t see anywhere to turn of shared mailbox rights here.

image
image1792×749 37.2 KB

We do have Exchange Online management enabled for Entra and that is working if that is what you are referring to. IT just shows Shared Mailboxes as a GUID

6

Can you please share the screenshot where I can see this info.

shared mailbox rights get displayed on the account as a GUID

7

Hi Manish,

Were would you expect to see that setting? I don’t see that setting anywhere in the application xml in debug, task settings, or in the schema.

8

Can you show a screenshot of an account on an identity?

9

Based on these screenshots, sharedMailbox is a string attribute, not a reference to another object type on the application

Look at channel, or assignedPlans. Those attributes have a specified object type relating to the ManagedAttribute created for those on group aggregation

Do you have a specific group type for shared mailbox?

10

Hi Robert,

HEre is a screenshot of what we are seeing on the accounts

image

We configured the schema based on the following doc, Based on the doc it doesnt look like aggregation of sharedMailboxes is supported as an entitlement type. Is that what you were suggesting or am I missing something?

To aggregate shared mailbox attributes as an Entitlement, add sharedMailbox as an account attribute.

Example Name: sharedMailbox

Type: String

Property: Multivalued, Entitlement
11

@mrioux Understood. Have you tried importing the mapping from Entitlement Catalog? or write a rule to get the values using REST/Graph APIs and update it programmatically?

12

Entra ID connector aggregates shared mailboxes in the account aggregation. Do you have an identity cube for each shared mailbox? If so, you can use customization rule to map shared mailbox rights with their identity names.

13

After opening a case with support the recommendation was made to add the following entry key in debug to pull in sharedMailbox entitlements with a displayName

      <entry key="useDisplayNameForSharedMailbox">
        <value>
          <Boolean>true</Boolean>
        </value>
      </entry>