Exchange Online Provisioning through MIM

In a complex environment, being in an Exchange hybrid configuration for an extended period of time seems largely unavoidable.

In our Exchange Hybrid configuration, even with 99% of all mailboxes moved to Exchange Online, we’re still very reliant on our on-prem processes and automation, and therefore MIM provisioning.

I spent a while working this out, eventually getting the MIM sync engine ADMA Exchange provisioning extensions to handle all provisioning in Exchange Online.  We provision person, shared, equipment and room mailboxes using this method, with and without archives.

Essentially the ADMA Export will run ‘update-recipient’ and create a MailUser of type RemoteMailbox, Subsequent ADConnect synchronisation will flow msExchRemoteRecipientType, triggering Exchange Online to provision mailboxes and archives accordingly.  For us, this was tied in with group-based licensing to ensure that licenses are allocated in a timely manner.

Based on attribute flow, the result will be MIM either provisioning an on-prem mailbox, or a MailUser remote mailbox object.

• MailUser – Flow mailNickname and targetAddress. Target Address is constructed to be accountName@tenant.mail.onmicrosoft.com
• Remote Mailbox – MailUser + msExchRemoteRecipientType, msExchRecipientTypeDetails and msExchRecipientDisplayType will trigger mailbox creation (and archive for people) in Exchange Online, and ensure recipient type details of a remote mailbox with the correct sub-type (eg room, shared).
• On-prem Mailbox only - mailNickname, msExchHomeServerName and homeMDB

Based on an attribute determining where the mailbox should be created, we use a bunch of ugly nested IIF statements in a custom expression in our outbound initial-flow only rules, such as:

Attribute	Expression
mailNickname	accountName
targetAddress	IIF(Eq(MailboxLocation,"Office365"),accountName+"@tenant.mail.onmicrosoft.com",Null())
msExchRecipientDisplayType	IIF(Eq(MailboxLocation,"Office365"),IIF(Eq(accountType,"Person"),-2147483642,IIF(Eq(accountType,"Shared"),-2147483642,IIF(Eq(accountType,"Room"),-2147481850,IIF(Eq(accountType,"Equipment"),-2147481594,-2147483642)))),Null())
msExchRecipientTypeDetails	IIF(Eq(MailboxLocation,"Office365"),IIF(Eq(accountType,"Person"),2147483648,IIF(Eq(accountType,"Shared"),34359738368,IIF(Eq(accountType,"Room"),8589934592,IIF(Eq(accountType,"Equipment"),17179869184,2147483648)))),Null())
msExchRemoteRecipientType	IIF(Eq(MailboxLocation,"Office365"),IIF(Eq(accountType,"Person"),3,IIF(Eq(accountType,"Shared"),97,IIF(Eq(accountType,"Room"),33,IIF(Eq(accountType,"Equipment"),65,1)))),Null())

This equates to:

Account Type	msExchRemoteRecipientType	msExchRecipientTypeDetails	msExchRecipientDisplayType
Shared	1 (provision mailbox)	34359738368	-2147483642
Room	33 (provision mailbox, room)	8589934592	-2147481850
Equipment	65 (provision  mailbox, equipment)	17179869184	-2147481594
Person	3 (provision mailbox + archive)	2147483648	-2147483642

Most of the attribute values were taken from here:

Recipient Type Values

https://answers.microsoft.com/en-us/msoffice/forum/msoffice_o365admin-mso_exchon-mso_o365b/recipient-type-values/7c2620e5-9870-48ba-b5c2-7772c739c651