Disable OWA using AzureAD Connector

[billychanjy]

Hi everyone,

We are implementing outlook email provisioning where we use AzureAD connector to create account and provision Office 365 E1 license for email.

Client wants to disable Outlook on the Web (OWA) upon creating the account and assigned with the license.

Are there solutions on using AzureAD connector to disable Outlook on the Web (OWA)?

If not, are there ways to cater this use case?

Thanks in advance.

[rushikeshvartak]

Using Microsoft Graph API

You can also use the Microsoft Graph API to manage user settings, including disabling OWA. This would involve making a POST request to the Graph API endpoint to update the user’s mailbox settings.

Here's a simplified example of how you might approach this with the Graph API:

• Request: PATCH https://graph.microsoft.com/v1.0/users/{user-id}/mailboxSettings
• Body:
  { "owaEnabled": false }

You would need to have appropriate permissions to update mailbox settings and handle authentication for the API calls.

[billychanjy]

Hi Rushikesh,

I've checked the properties under mailboxSettings through this website - mailboxSettings resource type - Microsoft Graph v1.0 | Microsoft Learn

It seems like there is no property "owaEnabled" under mailboxSettings, could you suggest an alternative method?

Thanks.

[rushikeshvartak]

Did you tried from postman ?

[billychanjy]

Hi Rushikesh,

Yes, we tried to use the Microsoft Graph API to trigger in Saviynt.
Below is the result.

Thanks.

[rushikeshvartak]

Alternative: Microsoft Graph API (via Conditional Access Policies)

If you're set on using the Graph API, you can achieve something similar by enforcing Conditional Access Policies to block access to OWA. This approach, however, doesn’t disable OWA outright, but it restricts access.

Here’s an outline:

1. Create a Conditional Access Policy that blocks access to "Exchange Online" for the specific user or group and applies only to the "Web" client (which is OWA).

2. Use Microsoft Graph API to manage Conditional Access policies:

   • Example API endpoint: https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies
   • You would need to craft a policy to block web-based access to Exchange.