The EmpowerID Office 365 connector allows you to add a Microsoft Office 365 domain to the EmpowerID Identity Warehouse as a managed account store. The EmpowerID Office 365 connector uses PowerShell to perform administrative tasks in the connected domain, such as creating and deleting users, mailboxes and groups.

The account that EmpowerID uses to connect to Office 365 must have the ability to create a service principal that allows the application to access your Office 365 tenant’s information. By default, EmpowerID uses an Office 365 account with the Global Admin role to create the service principal. If you do not want to use a Global Admin account, you will need to provide a service principal account with either one of the below permissions (depending on whether the service principal account is to be used for tenant administration):

Directory Readers permissions — Read permission only; this type of account does not provide tenant administrative capabilities
User Account Administrator — This type of account provides user administrative capabilities within the tenant.

The service principal can be created in PowerShell. For more information, see Microsoft’s article at https://docs.microsoft.com/en-us/powershell/azure/create-azure-service-principal-azureps?view=azps-3.3.0. Please note that if you chose to provide your own service principal, the account must be maintained by your organization.

Prerequisites

You must have an Office 365 Business account with Microsoft, and install the specified versions of the following modules on each EmpowerID server you want to use to manage the domain.

If your EmpowerID servers have Windows Azure AD Module for Windows PowerShell and MSOnline Sign-In Assistant installed, you must remove them before installing the required version.

You must install the following modules in this order.

Windows Management Framework 5.1
This version provides functionality that EmpowerID uses to communicate with Office 365, including the newest version of Windows PowerShell.

Select the file with your server's version in the name, e.g. Win8.1AndW2K12R2-KB3191564-x64.msu for Windows Server 2012-R2.

This includes Windows Azure Active Directory Module for Windows PowerShell, which provides you with the Office 365 cmdlets to administer Office 365.
To verify the version, in Powershell, run $PSVersionTable.PSVersion
The version must be Major 5 Minor 1 or higher.
In PowerShell, run this command:
Install-Module -name MSOnline -MinimumVersion 1.1.166.0 -MaximumVersion 1.1.166.0
If you see these messages, enter Y for both.
- PowerShellGet requires NuGet provider version '2.8.5.201' or newer
- You are installing the modules from an untrusted repository
To confirm the version, in PowerShell, run these two commands:
Import-Module MSOnlineGet-Module MSOnline
The version must be 1.1.166.0.
Version 1.1.183.8 is not compatible.

Before connecting EmpowerID to an external directory, please review the Getting Started with Directory Systems topic. The topic walks you through the prerequisites you need to complete before connecting to an external directory for the first time. These prerequisites include:

Configuring the appropriate server roles for your EmpowerID servers
Reviewing the Join and Provision Rules for your environment
Reviewing the Join and Provision Filters for your environment

If you have already connected EmpowerID to another external directory, you can skip these prerequisites.

Before connecting EmpowerID to a directory system, you should determine whether you want EmpowerID to provision Person objects from the user accounts it discovers in the account store. If you do, then you should be able to answer the following questions before turning on inventory.

When do you want EmpowerID to provision Person objects for those user accounts? At inventory or at a later point in time using the Account Inbox (recommended)?
If inventory provisioning is desired, in what Business Role and Location should those Person objects be placed?
How many user accounts can one Person have in the account store?
If people can have more than one user account in the account store, do you want EmpowerID to attempt to automatically join any user accounts meeting the conditions of your Join rules to an existing Person during inventory?
Do you want attribute flow to occur between EmpowerID and the account store? If so, what rules do you want to apply?
If you have Resource Entitlement policies in place, do you want EmpowerID to apply them to the account store?

To create an account store for Office 365

In the Navigation Sidebar, expand Admin, then Applications and Directories, and select Account Stores and Systems.
Click the Actions tab, and then click the Create Account Store action.

The Add New Security Boundary page appears.
Search for "office," select Office365, and click Submit.
In the Office 365 Details page that appears, supply values for the following fields and click Submit.
- Name — Enter a name for your account store.
- Display Name — Enter a display name for your account store.
- Fully Qualified Name — Enter the fully qualified name of your Office 365 account as it was originally issued from Microsoft, e.g. myaccount.onmicrosoft.com.
- User Name — Enter the email address for the Office 365 account EmpowerID is to use to connect to your Office 365. Please note that if EmpowerID needs to create the service principal for making Graph API calls, this account must be a global administrator.
- Password — Enter the password of your Office 365 global administrator. Please note that if EmpowerID needs to create the service principal for making Graph API calls, this account must be a global administrator.

To edit account store settings

In the navigation sidebar, expand Admin, then Applications and Directories, and click Account Stores and Systems.
On the Account Stores tab, search for the account store you just created and click the link to go to its details page.
On the Account Store Details page, click the Edit button or the name of the account store.
In the edit view of the page, you can edit values in any of the enabled fields. In the General section, these are:
- Display Name – Edit the name of the account store as it appears in the list of account stores.
- Proxy Connection Account – Change the domain, user name, and password for the connection.
- Account Store Proxy Shared Credential – Click in this box and press Enter to see a list of shared credentials in your system to use for the proxy connection.
- Password Manager Policy – Select a password manager policy to use for the account. If not selected, it uses the Default Password Manager Policy.
- Application ID – not applicable for Office 365
- Tenant ID – not applicable for Office 365
- Use Secure Binding – not applicable for Office 365
- Show in Tree – Toggle to show the account store in the Locations tree.
- Default User Creation Path – Select a location in which to create users if none is specified.
- Default Group Creation Path – Select a location in which to create groups if none is specified.
- EmpowerID Group Creation Path – Select a location in which to create EmpowerID groups if none is specified.
- Max Accounts per Person – Enter the maximum number of user accounts from this domain that an EmpowerID Person can have linked to them. This prevents the possibility of a runaway error caused by a wrongly configured Join rule. We recommended setting this value to 1 unless users commonly have multiple accounts and you want them to be joined to the same person.
In the Features section, you can select any of these values:
- Use for Authentication –
- Allow Search for User Name in Authentication –
- Allow Password Sync – Toggle to allow EmpowerID to sync password changes discovered during inventory.
- Queue Password Changes – Toggle to have EmpowerID send password changes to the Account Password Reset Inbox for batch processing.
- Queue Password Changes on Failure – Toggle to have EmpowerID send password changes to the Account Password Reset Inbox only when the change fails.
- Allow Account Creation on Membership Request – Toggle to allow users without accounts to request group membership and automatically have an account created.
- Batch Calls –
- Allow Attribute Flow – Toggle to allow attribute changes to flow between EmpowerID and the account store.
- Allow Person Provisioning – Toggle to allow EmpowerID to create Person objects from the user records discovered during inventory.
- Allow Provisioning – Toggle to allow EmpowerID to create new Groups in ServiceNow from requests discovered during inventory.
- Allow Deprovisioning – Toggle to allow EmpowerID to delete Groups in ServiceNow based on requests discovered during inventory.
- Automatic Person Join – Toggle to allow EmpowerID to join newly discovered accounts to people during the inventory process if they meet the Join Rule as specified by the Custom_Account_InventoryInboxJoinBulk SQL stored procedure.
- Automatic Person Provision – Toggle to allow EmpowerID to provision EmpowerID people for new accounts discovered during the inventory process if they meet the Provision Rule specified by theCustom_Account_InventoryInboxGetAccountsToProvision SQL stored procedure.
- Default Provision Business Role – Set a default Business Role to assign people if none is specified.
- Default Provision Location – Set a default Location to assign people if none is specified.
- Allow Business Role and Location Re-Evaluation – Toggle if you have multiple account stores to manage and want to specify a priority for each.
- Business Role and Location Re-Evaluation Order – Enter a number to specify the priority of the account store for determining the Business Roles and Locations to assign to a Person. Account Stores with a higher value take precedence.
- Recertify All Group Changes – Toggle to allow EmpowerID to generate recertification review tasks for all changes in ServiceNow Groups.
When you have finished editing, click Save.

To configure Attribute Flow rules

Point your browser to the URL for accessing the EmpowerID Web portal in your environment and log in as an administrative user.
From the Navigation Sidebar of the EmpowerID Web interface, expand Admin > Applications and Directories and click Attribute Flow Rules.
From the Attribute Flow Rules page, click the Advanced Search drop-down arrow to the right of the search field to open the Advanced Search pane.
Enter the name of your Office 365 account store in the Account Store field and then either click the Search button or press ENTER.
Click X to close the Advanced Search pane.
Review the flow rules and make changes as needed by clicking the drop-down arrow to the right of the attribute whose flow rule you want to change and then select the appropriate flow rule from the drop-down menu.
After reviewing and making any needed changes to the attribute flow rules, return to the Office 365 Account Store Details screen in Configuration Manager.
From the Inventory pane, toggle the red sphere to the left of Enable Inventory to a green check box. This allows EmpowerID to inventory your Office 365 and create the appropriate user accounts and Person objects (when Person Provisioning is enabled for the account store) in EmpowerID.

If you are using the Account Inbox to provision or join the user accounts in the external directory to Empower Persons, you need to turn on the Account Inbox. This is demonstrated in the below section.

To enable the Account Inbox permanent workflow

From the Navigation Sidebar of the EmpowerID Web interface, expand Admin > EmpowerID Servers and Settings and click Permanent Workflows.
From the Permanent Workflows page, click the Display Name link for Account Inbox.
From the View One page for the workflow that appears, click the edit link for the workflow.
From the Permanent Workflow Details form that appears, select Enabled and then click Save. Based on the default settings applied to the workflow, EmpowerID will process 1000 of the user accounts in the Account Inbox every ten minutes, provisioning Person objects from those user accounts and joining them together based on the Join and Provision rules applied to the account store.

To monitor inventory

From navigation sidebar, expand System Logs > Policy Inbox Logs and click Account Inbox.

The Account Inbox page appears. This page provides tabbed views of all information related to processing new user accounts discovered in a connected account store during inventory. An explanation of these tabs follows.

Dashboard - This tab provides a quick summary of account inbox activity.
Not Processed - This tab displays a grid view of all inventoried user accounts not yet used to provision a new EmpowerID Person or joined to an existing Person. Any accounts that fail to meet the Join and Provision rules are displayed here as well.
Failed - This tab displays a grid view of any account joining or provisioning failures.
Ignored - This tab displays a grid view of all accounts ignored by the account inbox. Accounts are ignored if they do not qualify as user accounts.
Joined - This tab displays a grid view of all accounts joined to an EmpowerID Person. Joins occur based on the Join rules applied to the account store.
Processed - This tab displays a grid view of all accounts that have been used to either provision a new EmpowerID Person or joined to an existing EmpowerID Person.
Provisioned - This tab displays a grid view of all accounts that have been used to provision an EmpowerID Person. Provisioning occurs based on the Provision rules applied to the account store.
Orphans - This tab displays a grid view of all user accounts without an EmpowerID Person.
All - This tab displays a grid view of all user accounts and the status of those accounts in relation to the Account Inbox.

If your Office 365 subscription includes Exchange Online, you can configure EmpowerID to inventory and enforce permissions for Exchange, as well as to perform batch processing for Exchange Online actions. For more information, see Configuring EmpowerID for Exchange Online Management.

On this page