Exchange Online Provisioning through MIM

In a complex environment, being in an Exchange hybrid configuration for an extended period of time seems largely unavoidable.

In our Exchange Hybrid configuration, even with 99% of all mailboxes moved to Exchange Online, we’re still very reliant on our on-prem processes and automation, and therefore MIM provisioning.

I spent a while working this out, eventually getting the MIM sync engine ADMA Exchange provisioning extensions to handle all provisioning in Exchange Online.  We provision person, shared, equipment and room mailboxes using this method, with and without archives.

Essentially the ADMA Export will run ‘update-recipient’ and create a MailUser of type RemoteMailbox, Subsequent ADConnect synchronisation will flow msExchRemoteRecipientType, triggering Exchange Online to provision mailboxes and archives accordingly.  For us, this was tied in with group-based licensing to ensure that licenses are allocated in a timely manner.

Based on attribute flow, the result will be MIM either provisioning an on-prem mailbox, or a MailUser remote mailbox object.

• MailUser – Flow mailNickname and targetAddress. Target Address is constructed to be accountName@tenant.mail.onmicrosoft.com
• Remote Mailbox – MailUser + msExchRemoteRecipientType, msExchRecipientTypeDetails and msExchRecipientDisplayType will trigger mailbox creation (and archive for people) in Exchange Online, and ensure recipient type details of a remote mailbox with the correct sub-type (eg room, shared).
• On-prem Mailbox only - mailNickname, msExchHomeServerName and homeMDB

Based on an attribute determining where the mailbox should be created, we use a bunch of ugly nested IIF statements in a custom expression in our outbound initial-flow only rules, such as:

Attribute	Expression
mailNickname	accountName
targetAddress	IIF(Eq(MailboxLocation,"Office365"),accountName+"@tenant.mail.onmicrosoft.com",Null())
msExchRecipientDisplayType	IIF(Eq(MailboxLocation,"Office365"),IIF(Eq(accountType,"Person"),-2147483642,IIF(Eq(accountType,"Shared"),-2147483642,IIF(Eq(accountType,"Room"),-2147481850,IIF(Eq(accountType,"Equipment"),-2147481594,-2147483642)))),Null())
msExchRecipientTypeDetails	IIF(Eq(MailboxLocation,"Office365"),IIF(Eq(accountType,"Person"),2147483648,IIF(Eq(accountType,"Shared"),34359738368,IIF(Eq(accountType,"Room"),8589934592,IIF(Eq(accountType,"Equipment"),17179869184,2147483648)))),Null())
msExchRemoteRecipientType	IIF(Eq(MailboxLocation,"Office365"),IIF(Eq(accountType,"Person"),3,IIF(Eq(accountType,"Shared"),97,IIF(Eq(accountType,"Room"),33,IIF(Eq(accountType,"Equipment"),65,1)))),Null())

This equates to:

Account Type	msExchRemoteRecipientType	msExchRecipientTypeDetails	msExchRecipientDisplayType
Shared	1 (provision mailbox)	34359738368	-2147483642
Room	33 (provision mailbox, room)	8589934592	-2147481850
Equipment	65 (provision  mailbox, equipment)	17179869184	-2147481594
Person	3 (provision mailbox + archive)	2147483648	-2147483642

Most of the attribute values were taken from here:

Recipient Type Values

https://answers.microsoft.com/en-us/msoffice/forum/msoffice_o365admin-mso_exchon-mso_o365b/recipient-type-values/7c2620e5-9870-48ba-b5c2-7772c739c651

Finding where a user is logging on from

For years I’ve been using a doskey macro I created to Find a User.

In an enterprise environment, the logic is:

• Every normal user account has their home server mapped automatically, establishing a persistent SMB session with the home server from their workstation 
• Find the home server and query it to find the where the user is connecting from 
• Resolve the address and report who is connecting from where.

A few limitations:

1. This will only work if the home server is a Windows box 
2. You will need permissions to query win32_serversession of the home remotely (typically admin) 
3. If the person is connecting over Citrix or DirectAccess or another jump box, it will resolve to that source, instead of (or sometimes as well as) a workstation.

A quick PowerShell equivalent (with zero error checking):

function Find-User ($username) {
  $homeserver = ((get-aduser -id $username -prop homedirectory).Homedirectory -split "\\")[2]
  $query = "SELECT UserName,ComputerName,ActiveTime,IdleTime from win32_serversession WHERE UserName like '$username'"
  $results = Get-WmiObject -Namespace root\cimv2 -computer $homeServer -Query $query | Select UserName,ComputerName,ActiveTime,IdleTime
  foreach ($result in $results) {
    $hostname = ""
    $hostname = [System.net.Dns]::GetHostEntry($result.ComputerName).hostname
    $result | Add-Member -Type NoteProperty -Name HostName -Value $hostname -force
    $result | Add-Member -Type NoteProperty -Name HomeServer -Value $homeServer -force
  }
  $results
}

# Find one or more users
$users = "user1", "user2", "user3"
$users | % {Find-User $_} | ft -wrap -auto

# Find the members of a group
get-adgroupmember -id SG-Group1 | % {Find-User $_.samaccountname} | ft -wrap -auto

The original (and still the best) doskey macro:

FU=for %g in ($1 $2 $3 $4 $5 $6 $7 $8 $9) do @for /f "tokens=2 delims=\" %i in ('"dsquery user -samid %g | dsget user -hmdir | find /i "%g""') do @for /f "skip=1 tokens=1-3" %m in ('"wmic /node:"%i" path win32_serversession WHERE "UserName Like '%g'" Get ComputerName,ActiveTime,IdleTime"') do @for /f "tokens=2" %q in ('"ping -a %n -n 1 | find /i "pinging""') do @echo %q %g %n %i %m %o

Create the macro above with doskey:

doskey /listsize=1000 /macrofile=c:\util\macros.txt
FU user1

Wayne's World of IT (WWoIT). 

Querying ERE's from the fimservice database

I occasionally review the EREs floating about the system - the expected rule entries used to put objects in scope of traditional OSR sync rules - either to try and identity and clean-up orphans or just provide some stats.

There are two easy ways listed below to get this from the fimservice database - the first is the quick/dirty way, the second is the proper but very slow way.

This information is also available in the sync engine, but as they originate from the fim service it seems better to query from there.

/* ERE count from the MIM database, just found some object types and keys that looked correct. SQL takes seconds, PowerShell takes approximately forever with the FIMAutomation snap-in */

SELECT OVS.ValueString, Count(OVS.ValueString) 
FROM Fim.Objects OBJ
inner join fim.ObjectValueString OVS on OBJ.ObjectKey = OVS.ObjectKey
WHERE OBJ.ObjectTypeKey = 11
and OVS.AttributeKey = 66
group by OVS.ValueString

The slow (but supported) method, using the FIMAutomation snap-in

# Add the FIMAutomation snap-in
Add-pssnapin fimautomation

# The URI of your fim service endpoint
$uri = "http://fim01:5725/ResourceManagementService"

# Construct an output file based on today's date
$outputFile = "c:\temp\EREs_$([DateTime]::Now.ToString("yyyyMMdd")).csv" 

# All ERE's
$filter = "/ExpectedRuleEntry"

# Filter by a specific starts-with wildcard
#$filter = "/ExpectedRuleEntry[starts-with(DisplayName, 'AD: ')]"

# Filter by a specific sync rule name
#$filter = "/ExpectedRuleEntry[DisplayName = 'AD: CORP Inbound/Outbound User']"

# Export based on the filter
$objects = Export-FIMConfig -uri $URI -onlyBaseResources -customConfig $filter

# Group by displayname for a count per-sync rule
$objects.ResourceManagementObject.ResourceManagementAttributes | where {$_.attributename -eq 'DisplayName'} | select value | group-object -prop value | select count,name | ft -wrap -auto

# Export some details to CSV
$results = foreach ($object in $objects) {
  write-output "out" | select @{N='DisplayName';E={($object.ResourceManagementObject.ResourceManagementAttributes | where {$_.attributename -eq 'displayName'}).Value}},
                          @{N='CreatedTime';E={($object.ResourceManagementObject.ResourceManagementAttributes | where {$_.attributename -eq 'CreatedTime'}).Value}},
                          @{N='ObjectID';E={($object.ResourceManagementObject.ResourceManagementAttributes | where {$_.attributename -eq 'ObjectID'}).Value}} 
}
$results | export-csv -path $outputFile 

Wayne's World of IT (WWoIT). 

Office 365 licensing through MIM

This one is a few years old, but I haven’t seen anything similar so I thought I may as well share some information on a solution I put in place with MIM to manage Office 365 license and service plan allocation.

In summary:

1. Create a new object class in MIM for Office 365 service plans, and an instance for each sku/service plan.
2. Add a multi-valued reference attribute to each user to store which service plans are allocated
3. Create a new MV class and attributes and flow the data from the FIM MA into the metaverse.  This is only if you need the data in the MV (I exported this data to a SQL database MA for a script we were using before group-based licensing)
4. Create a new tab in the user editing RCDC to select Service Plans, delegated to whoever manages license allocation
5. Create a policy to allocate a default set of Service Plans during user provisioning
6. Create criteria-based groups exported out to AD and synchronised to AAD to use Azure Group-Based Licensing.

This provided a nifty way for us to delegate and control SKU’s down to the individual service plans.  This fit into our MIM-centric view of the world and tied in with our MIM reporting and delegation models.

Create FIM Resources, attributes and binding

Resource type to store office 365 license objects:

System Name	Office365License
Display Name	Office 365 License
Description	Office 365 and Azure AAD Licenses

New attribute for SKU, bound to Office365License

 

Object Type	System/Display Name	Type	Multi-valued	Description
Office365License	SKU	Indexed String	No	Office 365 SKU

Multi-valued reference property bound to users:

 

Object Type	System Name	Display Name	Type	Multi-valued	Description
Person	Office365ServicePlans	Office365 Service Plans	Reference (DN)	Yes	{None}

Note that there is no explicit link between the user bound attribute and the new resource type – technically any reference ID can be stored in the service plans attribute.  We are relying on the RCDC Filter to control which references are stored in this attribute.

Add an Office365 licensing tab to the user editing/creation RCDC

Add the following grouping.  Note that the binding source for the creation RCDC must be schema, rather than object as below (editing):

    <my:Grouping my:Name="Office365LicensesGroup" my:Caption="Office365" my:Enabled="true">

      <my:Control my:Name="SyncTo365" my:TypeName="UocCheckBox" my:Caption="{Binding Source=schema, Path=SyncTo365.DisplayName}" my:Description="{Binding Source=schema, Path=SyncTo365.Description}" my:RightsLevel="{Binding Source=rights, Path=SyncTo365}">

        <my:Properties>

          <my:Property my:Name="Required" my:Value="{Binding Source=schema, Path=SyncTo365.Required}"/>

          <my:Property my:Name="Text" my:Value="Synchronised to Office 365"/>

          <my:Property my:Name="Checked" my:Value="{Binding Source=object, Path=SyncTo365, Mode=TwoWay}"/>

        </my:Properties>

      </my:Control>

      <my:Control my:Name="Office365Licenses" my:TypeName="UocListView" my:Caption="Office 365 Licenses" my:Description="Office 365 Licenses." my:RightsLevel="{Binding Source=rights, Path=Office365ServicePlans}">

        <my:Properties>

          <my:Property my:Name="ColumnsToDisplay" my:Value="DisplayName,Description,SKU" />

          <my:Property my:Name="EmptyResultText" my:Value="There are no licenses available for this person." />

          <my:Property my:Name="ResultObjectType" my:Value="Office365License"/>

          <my:Property my:Name="PageSize" my:Value="10" />

          <my:Property my:Name="ShowTitleBar" my:Value="false" />

          <my:Property my:Name="ShowActionBar" my:Value="false" />

          <my:Property my:Name="ShowPreview" my:Value="false" />

          <my:Property my:Name="ShowSearchControl" my:Value="false" />

          <my:Property my:Name="EnableSelection" my:Value="true" />

          <my:Property my:Name="SingleSelection" my:Value="false" />

          <my:Property my:Name="SelectedValue" my:Value="{Binding Source=object, Path=Office365ServicePlans, Mode=TwoWay}"/>

          <my:Property my:Name="ItemClickBehavior" my:Value="ModelessDialog" />

          <my:Property my:Name="ReadOnly" my:Value="false" />

          <my:Property my:Name="ListFilter" my:Value="/Office365License" />

        </my:Properties>

      </my:Control>   

</my:Grouping>

 For example, the RCDC results in an ‘Office365’ tab for license allocation (and we also control synchronisation in this way)

Recycle the SharePoint app pool

$sharepoint
= Get-WMIObject -Computer "mim01 " -Namespace root\MicrosoftIISv2
-Authentication PacketPrivacy  -Query
"SELECT * from IIsApplicationPool where name = 'W3SVC/APPPOOLS/SharePoint
- 80'"
$sharepoint.recycle()

Create Office 365 licensing objects and allow sync to MV

 Set for access:

• All Office 365 Licenses

Create FIM MPRs to allow synchronisation

 

DisplayName	Synchronization: Synchronization account can read Office365Licenses it synchronizes
Description	Policy to allow synchronisation of Office365License objects
Type	Request
Requestor	Synchronization Engine
Operation	Read
Permissions	Grant
Target Resource Set	All Office 365 Licenses
Resource Attributes	All Attributes

  

DisplayName	Synchronization: Synchronization account controls Office365Licenses it synchronizes
Description	Policy to allow synchronisation of Office365License objects
Type	Request
Requestor	Synchronization Engine
Operation	Modify
Permissions	Grant
Target Resource Set	All Office 365 Licenses
Resource Attributes	All Attributes

Note that the modify policy above is required otherwise a’ failed-modification-via-web-services ‘ export error will occur: while exporting MVObjectID

Fault Reason: Policy prohibits the request from completing, Microsoft.ResourceManagement.WebServices.Exceptions.PermissionDeniedException

Create FIM MPRs for administrative access

Allow add/delete grant permissions to the set above:

 

Name	Administration: Administrators can control Office 365 licenses
Requestors	Administrators
Operation	Create, Delete, Add, Remove, Modify
Grants Permission	Yes
Target Resource Before	All Office 365 Licenses
Target Resource After	All Office 365 Licenses
Resource Attributes	All Attributes

 

Name	Administration: Administrators can read and update Users
Requestors	<No Change>
Operation	<No Change>
Grants Permission	<No Change>
Target Resource Before	<No Change>
Target Resource After	<No Change>
Resource Attributes	Add ‘Office 365 Service Plans’

Add the new object to the sync to the metaverse

Modify the All Resource | Synchronization Filter:

Synchronization Filter

Add Office365License

Create a new PowerShell session – the following error may be returned using an existing session:

Error= System.InvalidOperationException: Operation is not valid due to the current state of the object.

For example, create some EMS and E1 Service Plans, grouped by SKU:

 

DisplayName	Description	SKU
MFA	Azure Multi-factor authentication	EMS
Intune	Intune	EMS
RMS	Azure Active Directory Rights Management	EMS
Yammer	Yammer	E1
Sway	Sway	E1
Lync	Lync Online	E1
SharePoint	SharePoint Online	E1
Exchange	Exchange Online	E1

 Ensure a CSV file with the above table exists:

$licenses =
import-csv -path c:\temp\licenses.csv
 
foreach
($license in $licenses) {   
 
  #write-output "DisplayName:
'$($license.DisplayName)', Description: '$($license.Description)', SKU
'$($license.SKU)'"
  . .\CreateOffice365License.ps1 -displayName
$license.DisplayName -description $license.Description -sku $license.SKU
}

Create metaverse object class

 office365License:

Object Type	AttributesName
office365License	displayName description sKU csObjectID

 

Object Type	AttributeName	Type	Multi-valued	Indexed
office365License	sKU	String (indexable)	No	No

 person:

 

Object Type	AttributesName	Type	Multi-valued	Indexed
person	office365ServicePlans	Reference (DN)	Yes	No

 FIM MA:

Refresh Schema
Select Object Types	Office365License
Select Attributes	SKU, Office365ServicePlans
Object Type Mapping	Office365License -> office365License
Attribute Flow	office365License: Add SKU -> sKU Add DisplayName -> displayName Add Description -> description Remove ExpectedRulesList Remove DetectedRulesList
Attribute Flow	Person Add import Office365ServicePlans -> office365ServicePlans

Synchronise Office 365 licenses from FIM to the metaverse

1. Run FIM Full Import and Full Sync
2. FIM Export
3. FIM Full Import and Full Sync