Hi Experts,
I have an requirement of retain all the required licenses during the mail retention period and alon with this customer wanted to retain the default Azure AD entitlements also during this period.I haven’t found any info on the default entitlements required for Azure AD accounts. Can any help on this please?
Cheers,
VJ
I would think the source owner (or business leader) defines those default entitlements. I don’t think there are any out of the box entitlements that are default to an Azure AD account. I’d check with the Azure AD admin if they have defined any default entitlements that are required for retention.
Hello @Hanushma As per my knowledge, ISC doesn’t have a predefined concept of default Azure AD (Entra ID) entitlements. It only manages the groups, application roles, and other access that are aggregated from Entra ID.
For your requirement, retaining the required Microsoft 365/Exchange Online licenses during the mailbox retention period makes sense. However, when it comes to “default Azure AD entitlements,” Microsoft doesn’t provide a standard list that every user must have. In most cases, these are actually organization-specific baseline groups or application assignments, such as default security groups, Conditional Access groups, dynamic groups, or other baseline access configured by the customer.
I would recommend confirming with the customer what they mean by “default Azure AD entitlements.” Once those baseline groups or assignments are identified, you can exclude them from the deprovisioning process in ISC while removing all other access.
Hi @Hanushma,
ISC does not have an out-of-the-box concept of “default” Entra ID entitlements that are automatically retained during deprovisioning. It simply manages the groups, application roles, licenses, and other access objects that are aggregated from Entra ID.
For this requirement, the recommended approach is to identify the Microsoft 365/Exchange Online license, group memberships, or application roles that must remain assigned during the mailbox retention period, and handle those separately from the rest of the user’s access.
During deprovisioning, revoke only the access that should be removed while preserving the required Exchange Online entitlements until the retention period has ended. Once the retention period expires, those remaining entitlements can also be removed.
Since there is no Microsoft-defined list of “default” Entra ID entitlements, the baseline groups, licenses, or roles that need to be retained should be confirmed with your Entra ID administrators, as these are typically organization-specific.
Thank you all for the replies. Are their any fixed assignedLicesnes/groups/assignedPlans to be retained as part of mail rentention? can you please help with this query