Best Practice for Keeping Exchange Online OOO Active After User Termination in ISC

SailPoint Human Fabric (SHF) SHF Discussion and Questions
1

Hi Community,

We have the following offboarding process in SailPoint ISC:

  • User reaches termination date.
  • AD account is disabled immediately.
  • AD account is deleted after 60 days.

We now have a new requirement to keep the Exchange Online mailbox active only for sending Automatic Replies (Out of Office) for a configurable period (e.g., 4 weeks), while ensuring the user cannot sign in.

Has anyone implemented this in ISC?

  • Can SailPoint natively manage this, or is Microsoft Graph API/Exchange Online PowerShell required?
  • If the AD/Azure AD account is disabled, will the mailbox continue to send OOO replies?
  • What is the recommended/best practice for handling this scenario?

Any guidance or implementation experience would be appreciated. Thanks!

2

@ssharma02 This is a common use case.

Based on your post I assume you have the hybrid AD-Azure environment and answering your questions.

  • Can SailPoint natively manage this, or is Microsoft Graph API/Exchange Online PowerShell required?
  • If the AD/Azure AD account is disabled, will the mailbox continue to send OOO replies?
    • Disabling the AD and Azure account doesn’t impact the mailbox configuration.
    • When you remove the O363 license group from the user’s account, it will disable the mailbox.
    • Even without active license, the mailbox can still receive emails and process rules, auto-reply rule is one such a rule. But you cannot set this rule after the mailbox is disabled.
    • To answer your question, yes - an Exchange mailbox will still send auto replies after the AD or Azure account disabled and its O365 license is removed.
    • So, the process should be,
      • Set the auto-reply rule when you are disabling the AD accounts and before removing the license group.
      • Then, the autoreply rule persists until the mailbox disabled or deleted.
  • What is the recommended/best practice for handling this scenario?
    • It largely depends on the AD/Azure setup and the organization’s policies. However, the general process is:
      1. Disable the AD account. It should automatically disable the Azure account via AD-Connect.
      2. Set an automatic reply for the Exchange mailbox with the StartTime and EndTime parameters. This you can set during ISC disable AD account event via Workflow or afterModify connector rule.
      3. Remove the license group after a defined period following the termination date (optional, depending on Org license management)
      4. Delete the AD account.

Also, check how mailboxes are handled after termination - for example, whether they are converted to shared mailboxes or deleted and it may help you to handle it effectively

3

Hi @ssharma02

You can implement a termination workflow and in one of the steps of this, you can call the PowerShell script for mailbox use case.

4

First You need to implement time base termination, otherwise on early morning of termination day it will activate disablement of accounts.

Connector will not bale to manage it .

You can use Powershell Script for the above requirement and you will have the ability to handle failure and retires in PS script.