Exchange Online Iq service Powershell Issue

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Hello,

We have been working with our Azure team to integrate IIQ 8.3p2 with exchange online.

One of the issues we are currently facing is returning the exo mailbox attributes for end users.

We have been able to successfully retrieve 800 identities exo mailbox attributes but are still missing about 3000 identities mailbox attributes.

We turned the log up for the iqservice and discovered that command is what the iq service is running under the hood:
Get-EXOMailbox -Properties EmailAddresses, RetentionPolicy, WhenChanged, WhenCreated, Name, DistinguishedName, PrimarySmtpAddress, DisplayName, WhenMailboxCreated, ArchiveStatus, ArchiveQuota, ArchiveWarningQuota, UserPrincipalName, SamAccountName | Where-Object {($_.ExternalDirectoryObjectId -eq ‘Azure ID’)} | ConvertTo-Json".

For most users this command returns an empty set of mailbox attributes. We have discovered however that if the below commands are ran than the exchange mailbox attributes are retrieved successfully:

Get-EXOMailbox -Identity samAccountName -Properties EmailAddresses, RetentionPolicy, WhenChanged, WhenCreated, Name, DistinguishedName, PrimarySmtpAddress, DisplayName, WhenMailboxCreated, ArchiveStatus, ArchiveQuota, ArchiveWarningQuota, UserPrincipalName, SamAccountName

And
Get-EXOMailbox -ExternalDirectoryObjectId ‘Azure ID’ -Properties EmailAddresses, RetentionPolicy, WhenChanged, WhenCreated, Name, DistinguishedName, PrimarySmtpAddress, DisplayName, WhenMailboxCreated, ArchiveStatus, ArchiveQuota, ArchiveWarningQuota, UserPrincipalName, SamAccountName | ConvertTo-Json".

So it appears the problem is with the where clause.

I have a couple of questions:
1.) Has anyone else experienced this issue?
2.) Is there a way to change this built in command that the Azure AD connector is passing to the IQservice?
3.) Does an upgrade to 8.4 fix this issue? Does 8.4 or 8.4p2 run different powershell commands for exchange online connections?

2

Hi @chaynes2434

  1. Yes, I found EXO aggregation to be unusable in 8.3p2.
  2. It isn’t possible to change the command built-in to the IQService.
  3. 8.4p1 is slightly better, but still unusable. 8.4p2 is somewhat better and could be satisfactory if you don’t have a lot of mailboxes.
3

Hey Paul,

Do you know what exo command 8.4p2 runs under the hood?

Thanks
Christian

4

Hi Christian,

It believe it’s using commands like:

Get-EXOMailbox -Filter “(ExternalDirectoryObjectId -eq ‘123-456-abc’) -or (ExternalDirectoryObjectId -eq ‘789-abc-def’) …”

It does a command like that for each batch of object ids. The batch size is small, maybe 25 or so if I recall correctly. If you have lots of accounts then Get-EXOMailbox will be run many times.

We have more than 50,000 accounts and estimated a full aggregation would take most of a day to complete.

We developed a custom connector and use that instead. It does a full aggregation in 7 minutes.