Is there a way to set the immutable ID to null to disconnect mailboxes?

Question

We are trying to avoid the issue of deleting accounts and resting accounts, we want to implement disconnecting the account by setting the immutable id to null on accounts we want to keep.

Comments

Hello Carlos,

There is no possibility to clear the immutable ID natively in Adaxes. However, it does not seem to be required. Could you, please, describe the desired workflow in all the possible details with live examples?

---

First I need to state that we do not have any local mailboxes, all of mailboxes are in the could in exchange online, our environment is hybrid for the convenience of making changes in ad and have them replicate to the cloud.

In our hybrid enviroment when we want to disconnect a cloud mailbox Microsoft recommended to move the local AD object to an unsynced OU, what would happend from that point is that the next AD Sync cycle would cause an update in Azure, which in turn would delete the account. We feel it is unnecessary to do this, because we just lost a mailbox last week and MS support is not providing any solutions. We contacted a consultant and he recommeded to just remove the immutable ID instead of moving objects to an unsynced OU which would cause the mailbox to become detached from local AD so in fewer words we are tyring to avoid deleting and restoring users in azure to detach or unbind mailboxes to user adobjects in a hybrid environment.

Answer 1

Hello Carlos,

Thank you for clarifying. The recommended approach is correct. To achieve the desired, you can use the below script in your deprovisioning workflow. Make sure to install the MgGraph PowerShell module on all the computers where Adaxes service runs.

try
{
    # Get the object ID in Microsoft 365
    $objectId = ([Guid]$Context.TargetObject.Get("adm-AzureId")).ToString()
}
catch
{
    $Context.LogMessage("The user doesn't have a Microsoft 365 account.", "Error")
    return
}
$token = ConvertTo-SecureString -AsPlainText $Context.CloudServices.GetAzureAuthAccessToken() -Force

# Creat on-premises immutable ID
Connect-MgGraph -AccessToken $token
Update-MgUser -UserId $objectId -OnPremisesImmutableId @{}