Hi Antonio
I’m going to begin with the scheduling of the EXO License Group membership. I have to be honest, this is not tested, as all of my implementations have been as part of account create, so provided here for disucssion:
Option 1: Entra Entitlement for the EXO license. Not sure if you’ve got an Entra connector, but if so, you could utilise an extension attribute to represent a Boolean as to whether enable-remotemailbox has been run and then do a Dynamic assignment of the Entra Group. Include the extension attribute update in the PowerShell script so it enables the remote mailbox and then sets the flag when complete.
Option 2: AD Group for the EXO license. If you don’t have an Entra connector you could run the enable-remotemailbox via a Before Modify Rule. You shouldn’t get into a scheduling problem as the remote-mailbox will be enabled before the Entra Group is added via Entra Connect. The enable-remotemailbox simply adds attributes to the AD object, so the Entra User update is instantaneous on sync, whereas the license assignment from group membership is not immediate.
As for filtering the Rule, I would use a filter as described in IDN : AD After modify rule Query - #5 by ipobeidi to only trigger with specific payload in the request.