Shared mailboxes as entitlements on Azure connector

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Has anyone out there set up the Azure connector in IDN so that it will successfully bring in shared mailboxes? I have added sharedMailbox as an account attribute and added it as a group entitlement type and multivalued. The documentation for doing this in IDN is very muddy. If you have been successful, what are the steps that I need to perform other than the ones listed?

2

Assign the attribute type to String instead of Group.

  • Name: sharedMailbox
  • Type: String
  • Property: Multivalued, Entitlement
3

If you want to treat shared mailbox access as an entitlement, wouldn’t you want the type to map to an entitlement type and not be a string? Otherwise it seems it would just be a list of mailboxes the account has access to, similar to how the SiteCollections attribute works for the SharePoint connector

4

This is what I was thinking, but to what entitlement type? A custom one? If so what is the schema for it etc. The connector doc says it is supported but offers no detail. The detail it does have is wrong.

5

The documentation says to use String. Look in the Schema Configuration section of: Exchange Online Management

The connector will create multiple Entitlements based on whatever settings have been setup on the SharedMailbox.

6

Learn something new every day
Shooting Star GIF

7

Have you set this up in your environment? I have tried setting this to string, multivalued- and am getting nowhere.
The doc also says to set it to managed but that isn’t right either.

8

Yes it is running in my environment with these settings. The SharedMailbox information only comes in during Account Aggregations. Running an Entitlement Aggregation will not pull in the SharedMailboxes. You will only see them listed in Entitlements if an account has the SharedMailbox. So make sure an account has access to the SharedMailbox.

Also make sure you have the Exchange Online Configuration setup in the Feature Management section of the connector, and the account has the appropriate rights in Exchange.

1 Like
9

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.