Exchange Online Mailbox Auditing via SailPoint ISC

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hi All,

We have a requirement where we would like to enable auditing on newly created Exchange Online mailboxes via running a powershell script.

“Set-Mailbox user -AuditOwner @{Add=“SearchQueryInitiated”}”
Where “user” is the AccountUPN.

The users are getting created in AD via SailPoint ISC.
The AD is getting synced to Entra every 30 minutes.

Earlier we were trying to run the aftercreaterule attached to AD source however as the mailbox is on exchange online it would need to be attached to Entra ID source i believe.

We are not provisioning accounts in Entra directly via SailPoint ISC and instead using Entra Sync.

Has anyone come across any similar challenge and advise the best way to achieve this.

Thank You

2

Hi @yasha ,

Have you tried adding a sleep time in the script after the user is created in AD? As you mentioned, it takes around 30 minutes for the user to sync from AD to AAD.

I’m thinking that using an AfterCreate rule and introducing a 30–35 minute delay within that rule might help resolve the issue. This would allow sufficient time for synchronization before any subsequent actions are triggered.

Please let me know your thoughts on this approach.
Thank you.

3

Hello @yasha ,

I have come across the similar type of scenario where Entra Acocunt is not created directly from SailPoint ISC but its created through backend sync b/w On Prem AD and Entra.

Now, this scenario, the way I handled provisioning operations which are dependent on ENTRA ID account creation of the user which happens after BackEnd Sync is as follows.

  1. Create an Identity Attribute in your respective Identity Profile, lets say, named as “Entra ID Email“
  2. To the above identity attribute, attach a FirstValid Transform where you are assigning “mail“ account attribute value from ENTRA or a Default Value. Refer a below example.
{
  "name": "Test - FirstValid - EntraEmail",
  "type": "firstValid",
  "attributes": {
    "values": [
      {
        "attributes": {
          "sourceName": "Entra-Source",
          "attributeName": "mail"
        },
        "type": "accountAttribute"
      },
      {
        "attributes": {
          "sourceName": "Entra-Source",
          "attributeName": "objectId"
        },
        "type": "accountAttribute"
      },
      {
        "attributes": {
          "value": "NO_ENTRA_ACCOUNT"
        },
        "type": "static"
      }
    ],
    "ignoreErrors": true
  },
  "internal": false
}
  1. Once the above setup is done, make sure you are creating AD After Modify Connector Rule and provide your logic of enabling AUDIT for newly created mailbox. In the “AD After Modify Connector Rule“, make sure you are writing the logic of triggering this PowerShell script of Enabling AUDIT for Mailbox in such a way that it triggers only when value for Account Attribute of “extensionAttribute1“ is not equals to “NO_ENTRA_ACCOUNT“
  2. In the Create Profile of AD, create a new account attribute, lets say any unused extension Attribute (For sake of this example, lets say we use “extensionAttribute1“). Create a new account attribute in Create Profile of AD named as “extensionAttribute1“.
  3. Map extensionAttribute1 to Identity Attribute Named as “Entra ID Email“. Save the configurations on Create Account Profile page of AD.
  4. In the attribute sync page of AD, enable the attribute sync for “extensionAttribute1“
  5. Attach the “After Modify AD Connector“ rule to the AD source and save the configurations.
  6. Note –> Make sure that Provisioning Time Out for AD source is increased from default 60 seconds to lets say 90 or 120 or 150 seconds depending upon sleep time you have configured in your PowerShell script.

This solution will help you enable the AUDIT for your mailbox only when ENTRA Account is created from Backend Sync with On Prem AD and has got aggregated & correlated back in ISC to respective identity. There is no need to put wait/sleep time of 30 mins because its not recommended to keep the thread open for that long, the recommendation is to keep the thread alive for at most 600 seconds and not more than that.

4

Hi @yasha It is my understanding that you can run EXO powershell from the IQ Server connected to your AD connector, but bear in mind that you will need to use the Exchange Online Powershell module version of set-mailbox, set up Entra credentials with suitable permissions and configure authentication within your script.

5

IMO, you’re better off parking this script over to the Azure automation side of things. Treat AD / Entra as a semi-walled garden / ecosystem. Once you’ve created what you want to create on AD, and let the Entra Sync deal with the rest on the other side. Let the Entra / Exchange SME continue to govern their garden.

i.e. If you don’t have direct management channel into a staggered downstream system (Entra / Exchange Online), then it’s not for you to manage, generally speaking.

e.g. I placed my pasta order to the waitress. It’s not for me to further go into the kitchen to spell out how I want the pasta to be laid out on the plate.

A balance between centralized automation (from IGA) vs degree of technology-specific autonomy.

6

Thank you for the responses. I will test the recommendations and update the thread on the outcome.