Azure AD - Unspecified Connector Failure

[sahincelik]

Hi experts,

I receive the following error message during add entitlement operation (a distribution list type group) through access request in Azure AD.

According to the integration guide, add/remove distribution list operation is supported.

However, it does not seem to be working and the error message does not tell me anything actually. Can anyone help me out here? Thanks in advance!

[jishnu_suresh]

Hi Sahin,

Add/remove entitlement functionality was working when we tried provisioning for an azure only group (Created directly in AAD and not available in AD). For an AD group which was synced to Azure, and if we try to do provisioning directly to Azure group, this functionality for not working for me.

[sahincelik]

Hi Jishnu,

Thanks for your message. I think you are right, because I checked with someone who has global admin privilige in Azure AD, that person also could not add/remove users directly in Azure.

[sahincelik]

Hi @jishnu_suresh , I checked the groups and they only exist in Azure AD, so this is not the same case for us. Do you have any other idea what might be causing this?

[jishnu_suresh]

Hi Sahin,
Can you also check this document and see if the correct permissions is added to your ID?

Required Permissions

Regards,
Jishnu

[nikhleshsdg (Nikhlesh Sheoran)]

Hi @sahincelik,

Did you tried with other type of entitlement? Like group, access packages?

Thanks.

[sahincelik]

Thanks both. All the required permissions were already added. Plus, we granted Exchange Online Administrator. It does not fix the problem unfortunately. We are able to provision security groups but it does not work for Distribution Lists or Mail Enabled Security groups.

[varshini303 (VARSHINI SANKAR)]

Hi @sahincelik,

Looks like Microsoft has long back removed the ability to manage distribution lists and mail-enabled security groups affecting provisioning from SailPoint.

IDN and Distribution Lists

@faye_jacobs1 Microsoft Azure API has dropped support for managing mail enabled security groups and distribution groups. Now for the Azure Active Directory source, the distribution list groups and O365 mail enabled security groups cannot be added/removed as entitlements during provisioning operations. 1. Does that mean we won’t be able to manage our Azure DLs and Mail enabled security groups using IDN? You can still have them in IdentityNow but you cannot add or remove them as entitlements dur…

[sahincelik]

Hi @varshini303 I saw that too. But why SailPoint still keeps “adding/removing mail enabled security groups” withing the supported features?

Exchange Online Management (sailpoint.com)

[varshini303 (VARSHINI SANKAR)]

I think by supported operations, they would have meant that the exchange online mailboxes, distribution lists, and mail-enabled security groups could be managed by Exchange Online Powershell module through IQService.

Exchange Online Management

Microsoft Entra ID can be used to manage Exchange online mailboxes, distribution lists, and mail-enabled security groups. The Microsoft Entra ID connector uses Exchange Online PowerShell Module through IQService to support this feature. This is the companion discussion topic for the documentation at https://documentation.sailpoint.com/connectors/microsoft/entra_id/help/integrating_entra_id/exchange_online_mailbox_management.html

I guess this is not explicitly mentioned in the official document. Maybe, you can raise this as a feedback to the Docs Team for clear explanation.

Thanks!

[sahincelik]

Thanks for your explanation but I think it’s clear that these groups can be supported via OOTB connector. The pre-requisite to manage these groups is to install Exchange Online Module 3.0.0 in the IQService host which we already did. And, I see a lot of discussions about EXO mail enabled security group provisioning SailPoint community or developer pages. But, thanks anyway, I will raise a ticket for this or reach out Docs team. Do you know how to contact them?

[varshini303 (VARSHINI SANKAR)]

You can follow this to provide feedback on improvising docs.

Introducing a new comment system for documentation.sailpoint.com!

We are excited to announce that SailPoint official product Documentation now feature the ability to give feedback! Based on your feedback, this is provided through a carefully designed connection with our community! The @saas_docs_team & @connector_docs_team invite you to share your thoughts on how they can improve their docs. Does something need clarification? Do you have a suggestion on how we can improve our docs? Let’s talk about it! What does it look like? When viewing any documentation o…

Thanks!

[sahincelik]

I think an IQService restart is required after enabling the Exchange Online Management. That fixed the problem.