Imported RemoteUserMailbox Issue in Saviynt

[PratikPokale]

We've installed the Saviynt IIS Agent on the IIS server to execute commands on the Exchange server through Saviynt. We configured a REST connector to execute the script on the IIS server and set up the Security System, Endpoint, and Rules to create the task. Once the task is created, we run the provisioning job.

We are able to create, update, enable, and disable the RemoteUserMailbox, and we have imported all the RemoteUserMailboxes into Saviynt using the following JSON. However, we did not find any attribute in the RemoteUserMailbox that indicates whether the mailbox is active or not. Consequently, all mailboxes are shown as active in Saviynt.

Do you know any Exchange mailbox status attribute that indicates whether the mailbox is active?

We have observed an issue with imported mailboxes. Once the mailbox is imported into Saviynt, and if we delete a RemoteUserMailbox from Exchange and then import the mailboxes again, Saviynt shows the mailbox as active even though it has been deleted. Could you please provide guidance on how we can solve this issue?

Imported Account JSON:

{

   "accountParams": {

      "connection": "acctAuth",

      "processingType": "SequentialAndIterative",

      "call": {

         "call1": {

            "callOrder": 0,

            "stageNumber": 0,

            "http": {

               "url": "https://#####################/SaviyntApp/PS/ExecutePSScript",

               "httpParams": "{\"SCRIPT\": \"\\$password = '################' | ConvertTo-SecureString -AsPlainText -Force; \\$psCred = New-Object System.Management.Automation.PSCredential -ArgumentList ('#################', \\$password); \\$session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri 'http://############/powershell/' -Authentication Kerberos -Credential \\$psCred; Import-PSSession -Session \\$session -DisableNameChecking -AllowClobber; Get-RemoteMailbox -IgnoreDefaultScope -ResultSize Unlimited | Where-Object { \\$_.RecipientTypeDetails -eq 'RemoteUserMailbox' } | Select-Object Database,ExchangeGuid,SamAccountName,UserPrincipalName,WhenMailboxCreated,AccountDisabled,AddressListMembership,Alias,DisplayName,IsMailboxEnabled,PrimarySmtpAddress,Identity,Guid,RecipientType,RecipientTypeDetails,EmailAddresses; Remove-PSSession -Session \\$session\"}",

               "httpHeaders": {

                  "Authorization": "${accessToken}"

               },

               "httpContentType": "application/x-www-form-urlencoded",

               "httpMethod": "POST"

            },

            "statusAndThresholdConfig": {

               "deleteLinks": true,

               "accountThresholdValue": 400,

               "correlateInactiveAccounts": true,

               "inactivateAccountsNotInFile": true

            },

            "keyField": "accountID",

            "colsToPropsMap": {

               "name": "SamAccountName~#~char",

               "accountID": "SamAccountName~#~char",

               "customproperty1": "AccountDisabled~#~char",

               "displayname": "DisplayName~#~char",

               "customproperty3": "SamAccountName~#~char",

               "customproperty4": "PrimarySmtpAddress~#~char",

               "customproperty2": "UserPrincipalName~#~char",

               "customproperty5": "RecipientType~#~char",

               "customproperty6": "RecipientTypeDetails~#~char",

               "customproperty7": "Identity~#~char",

               "customproperty9": "Alias~#~char",

               "customproperty8": "Guid~#~char",

   "customproperty56": "EmailAddresses~#~char"

            }

         }

      }

   }

}

[rushikeshvartak]

Identifying Active Mailboxes

In Exchange, the AccountDisabled attribute can be used to indicate whether a mailbox is disabled. However, there isn't a direct "active" status attribute for mailboxes. Instead, you can use a combination of attributes to infer the status:

1. AccountDisabled: This indicates if the account is disabled.
2. WhenMailboxCreated: This indicates when the mailbox was created.
3. PrimarySmtpAddress: If the mailbox has a primary SMTP address, it is usually active.
4. RecipientTypeDetails: This can help identify the type of mailbox.

Handling Deleted Mailboxes

To address the issue of deleted mailboxes still appearing as active in Saviynt, ensure that your import process correctly identifies and marks accounts not present in the latest import as inactive or deleted. Here are steps to achieve this:

1. Modify the Import Process: Ensure the inactivateAccountsNotInFile parameter is set to true in your JSON configuration. This will mark any accounts not included in the latest import file as inactive in Saviynt.

2. Correlate Account Status: Use the AccountDisabled attribute to update the account status in Saviynt. If an account is disabled in Exchange, it should be reflected as inactive in Saviynt.

3. Deletion Handling: If a mailbox is deleted in Exchange, ensure that your script updates the status in Saviynt accordingly. You may need to extend your script to handle deletions explicitly.

[PratikPokale]

In the Client Exchange Environment, they use the following attributes: 
AccountDisabled: This indicates if the account is disabled. But for every remote user mailbox, this attribute is not true, whether the mailbox is disabled or not.
WhenMailboxCreated: This indicates when the mailbox was created. but we cannot use this attribute for the status of mailbox.
PrimarySmtpAddress: If the mailbox has a primary SMTP address, it is usually active. and every mailbox contains this attribute.
RecipientTypeDetails: This can help identify the type of mailbox. It only shows the type of mailbox, and we have used this attribute in our import JSON to segregate the mailbox type.

Currently, we are using the following statusAndThresholdConfig for importing mailboxes:
{
"statusAndThresholdConfig":{
"deleteLinks":true,
"accountThresholdValue":400,
"correlateInactiveAccounts":true,
"inactivateAccountsNotInFile":true
}
}
When we import the mailbox from Exchange to Saviynt, all mailboxes are imported, and some deleted mailboxes in Exchange will reflect as inactive in Saviynt.
Can you please guide us on how we can reflect the deleted mailbox as suspended from import in Saviynt?

[rushikeshvartak]

You need to store flags in custom property and in status threshold config based on flag you can make account status active or inactive

Sample

{
"statusAndThresholdConfig":
{
"statusColumn": "customproperty30",
"activeStatus": ["0"],
"deleteLinks": false,
"accountThresholdValue": 0,
"correlateInactiveAccounts": false,
"inactivateAccountsNotInFile": false
}
}