How to I delegate Send As permission and Full Access permission to a defined user during Deprovision?

Question

Using the built in 'Deprovision' Custom Command, I would like the person that is trying to Deprovision a user (Help Desk member) be asked who (from a list of existing active users) should be delegated permisson to the deprovisioned user's mailbox, then give that defined delegated user both Send As and Full Access permssion as part of the Deprovision custom command. (This would almost never be the manager.) The Help Desk person should have the option to leave the question 'blank', which means that no one gets access to the mailbox.

Answer 1

Hello Ray,

This can be done by adding an AD object picker parameter to the Deprovision Custom Command.

To add the parameter:

1. Launch Adaxes Administration Console.
2. In the Console Tree, expand your service node.
3. Navigate to Configuration\Custom Commands and select the Deprovision Custom Command.
4. In the Result Pane on the right, activate the Parameters tab and click New.
5. Select AD object picker and click Next.
6. Specify a parameter name and display name.
7. Click Next.
8. Configure what objects will be available for selection when executing the command.
9. Enable the Allow empty value checkbox.
10. Complete the wizard and save the changes.

You need to use a value reference to pass the parameter value to actions in the Custom Command. For more details about value references, please see this help article: https://www.adaxes.com/help/?ValueReferences.ValRefFormat.html.

In the Deprovision Custom Command, you need to modify the built-in action set that grants full access rights to the user’s manager so that the value of the parameter is used instead.

1. Replace the If the ‘Manager’ property is not empty condition with the If <parameter> <value> condition and select If <parameter> is not empty.
2. Replace the actions in the action set with the Modify Exchange properties action and specify the value reference to the parameter as a trustee for Full Access and Send As delegation.
3. Save the changes.

Finally, the action set should look something like this:

If you need to remove all existing trustees from the Mailbox Rights list when the value of the parameter is left blank, this can only be done using a PowerShell script. Please, take a look at this script from our repository: https://www.adaxes.com/script-repository/remove-all-trustees-from-full-access-list-s559.htm. The modified action set that also removes trustees from Mailbox Rights should look something like this:

If you need any assistance with modifying the script to meet your needs, please let us know, we will gladly help.