How to detect dormant 365 Accounts

Question

Hi everyone,

Finding and cleaning up dormant AD accounts is obviously pretty easy. But we have a bunch of email-only 365 accounts.

Does anyone have a good way that Adaxes can detect dormant 365 accounts? There is a lastlogontimestamp property within 365, but I'm not sure how we would have adaxes act on it...

Any ideas?

Comments

Hello Scott,

What exactly do you mean by "email-only 365 accounts"? Are they synchronized to Active Directory or they are present only in Office 365?

---

What I'm referring to are people with AD and email accounts, but they only ever use email and never logon to a PC, so things like 'LastLogon' attributes never get populated.

Our business has several hundred people in the field using email only on a company iDevice. A lot of these workers are transient, temp, seasonal, etc. We often never find out from managers when people leave, hence I'd like a way to detect inactive mailboxes.

Answer 1

Hello Scott,

Thank you for clarifying. This can be done using a PowerShell script. For example, you can group inactive users into a Business Unit. For details, see https://www.adaxes.com/script-repositor ... t-s509.htm.

Comments

I think that script should work...

I just tried running it against some test users (in the powershell script editor), and it's constantly erroring out:

"Exception calling "GetMailboxParameters" with "0" argument(s): "The mailbox is not created yet." Stack trace: at <Scriptblock>, <No File>: line 102.

It seems to not like that 'Getmailboxparameters' cmdlet.

Funny enough, I also enabled the 'Show object parameters' after execution, so I can see the user's parameters. Under Active Directory -> Office365 - it shows the user's proper O365 parameters. But under 'Exchange', it just sits and thinks and gets nowhere.

Tried this with multiple current users with valid E3 mailboxes - all the same result.

---

Hello Scott,

I just tried running it against some test users (in the powershell script editor), and it's constantly erroring out:

Did you modify the script? If you did, could you post here or send us (support[at]adaxes.com) the modified version of the script?

"Exception calling "GetMailboxParameters" with "0" argument(s): "The mailbox is not created yet." Stack trace: at <Scriptblock>, <No File>: line 102.

Could you post here or send us (support[at]adaxes.com) a screenshot of the execution log dialog box containing the error message?

Tried this with multiple current users with valid E3 mailboxes - all the same result.

Could you post here or send us (support[at]adaxes.com) a screenshot of what you see in the Office 365 and Exchange tabs?
Does the issue occurs for all the users or only for specific ones?

To help us troubleshoot the issue, do the following:

1. Enable tracing of PowerShell commands sent to Exchange servers as described in the following help article: https://www.adaxes.com/help/?HowDoI.Per ... uests.html.
2. Reproduce the issue.
3. Post here or send us (support[at]adaxes.com) the log file.

---

I will email everything you're asking to support in the next few minutes... Standby.

---

Hello Scott,

Thank you for the provided details. Could you check which roles are assigned in Office 365 to the account whose credentials were used to register your tenant in Adaxes?

---

We created a specific service account for Adaxes and gave it the 'User Management Administrator' role in 365.

Just now, for testing purposes, I changed it to 'Global Administrator', waited 20 minutes (sometimes permissions take a few minutes to take effect in 365)... Now it seems to connect to Exchange properly... All of the Exchange properties populate in Adaxes now when I click on user properties... The script also now works without error!

I would suggest 'User Management Administrator' might be enough for standard O365 tasks, but I'm not sure it's enough for Exchange. 'Global Administrator' roles add people into the 'tenant administrator' role in Exchange, but I don't think user management administrator does'.

---

Hello Scott,

You can check details about Office 365 roles in the following article: https://support.office.com/en-us/articl ... 090b6aaa9d.

According to the User Management Administrator role description, it does give access to Exchange. However, according to the Exchange log you provided, the role does not give access to all the required cmdlets which caused the issue. Thus, it is recommended to use an account that has the Global Administrator role assigned in Office 365 to register tenants in Adaxes.