The EmpowerID Office 365 connector allows you to add a Microsoft Office 365 domain to the EmpowerID Identity Warehouse as a managed account store. The EmpowerID Office 365 connector uses PowerShell to perform administrative tasks in the connected domain, such as creating and deleting users, mailboxes and groups.
To create an account store for Office 365
In the Navigation Sidebar, expand Admin, then Applications and Directories, and select Account Stores and Systems.
Click the Actions tab, and then click the Create Account Store action.
The Add New Security Boundary page appears.
Search for "office," select Office365, and click Submit.
In the Office 365 Details page that appears, supply values for the following fields and click Submit.
Name — Enter a name for your account store.
Display Name — Enter a display name for your account store.
Fully Qualified Name — Enter the fully qualified name of your Office 365 account as it was originally issued from Microsoft, e.g. myaccount.onmicrosoft.com.
User Name — Enter the email address for the Office 365 account EmpowerID is to use to connect to your Office 365. Please note that if EmpowerID needs to create the service principal for making Graph API calls, this account must be a global administrator.
Password — Enter the password of your Office 365 global administrator. Please note that if EmpowerID needs to create the service principal for making Graph API calls, this account must be a global administrator.
To edit account store settings
In the navigation sidebar, expand Admin, then Applications and Directories, and click Account Stores and Systems.
On the Account Stores tab, search for the account store you just created and click the link to go to its details page.
On the Account Store Details page, click the Edit button or the name of the account store.
In the edit view of the page, you can edit values in any of the enabled fields. In the General section, these are:
Display Name – Edit the name of the account store as it appears in the list of account stores.
Proxy Connection Account – Change the domain, user name, and password for the connection.
Account Store Proxy Shared Credential – Click in this box and press Enter to see a list of shared credentials in your system to use for the proxy connection.
Password Manager Policy – Select a password manager policy to use for the account. If not selected, it uses the Default Password Manager Policy.
Application ID – not applicable for Office 365
Tenant ID – not applicable for Office 365
Use Secure Binding – not applicable for Office 365
Show in Tree – Toggle to show the account store in the Locations tree.
Default User Creation Path – Select a location in which to create users if none is specified.
Default Group Creation Path – Select a location in which to create groups if none is specified.
EmpowerID Group Creation Path – Select a location in which to create EmpowerID groups if none is specified.
Max Accounts per Person – Enter the maximum number of user accounts from this domain that an EmpowerID Person can have linked to them. This prevents the possibility of a runaway error caused by a wrongly configured Join rule. We recommended setting this value to 1 unless users commonly have multiple accounts and you want them to be joined to the same person.
In the Features section, you can select any of these values:
Use for Authentication –
Allow Search for User Name in Authentication –
Allow Password Sync – Toggle to allow EmpowerID to sync password changes discovered during inventory.
Queue Password Changes – Toggle to have EmpowerID send password changes to the Account Password Reset Inbox for batch processing.
Queue Password Changes on Failure – Toggle to have EmpowerID send password changes to the Account Password Reset Inbox only when the change fails.
Allow Account Creation on Membership Request – Toggle to allowusers without accounts to request group membership and automatically have an account created.
Batch Calls –
Allow Attribute Flow – Toggle to allowattribute changes to flow between EmpowerID and the account store.
Allow Person Provisioning – Toggle to allow EmpowerID to create Person objects from the user records discovered during inventory.
Allow Provisioning – Toggle to allow EmpowerID to create new Groups in ServiceNow from requests discovered during inventory.
Allow Deprovisioning – Toggle to allowEmpowerID to delete Groups in ServiceNow based on requests discovered during inventory.
Automatic Person Join – Toggle to allowEmpowerID to join newly discovered accounts to people during the inventory process if they meet the Join Rule as specified by the Custom_Account_InventoryInboxJoinBulkSQL stored procedure.
Automatic Person Provision – Toggle to allowEmpowerID to provision EmpowerID people for new accounts discovered during the inventory process if they meet the Provision Rule specified by theCustom_Account_InventoryInboxGetAccountsToProvisionSQL stored procedure.
Default Provision Business Role – Set a default Business Role to assign people if none is specified.
Default Provision Location – Set a default Location to assign people if none is specified.
Allow Business Role and Location Re-Evaluation – Toggle if you have multiple account stores to manage and want to specify a priority for each.
Business Role and Location Re-Evaluation Order – Enter a number to specify the priority of the account store for determining the Business Roles and Locations to assign to a Person. Account Stores with a higher value take precedence.
Recertify All Group Changes – Toggle to allowEmpowerID to generate recertification review tasks for all changes in ServiceNow Groups.
When you have finished editing, click Save.
To configure Attribute Flow rules
Point your browser to the URL for accessing the EmpowerID Web portal in your environment and log in as an administrative user.
From the Navigation Sidebar of the EmpowerID Web interface, expand Admin > Applications and Directories and click Attribute Flow Rules.
From the Attribute Flow Rules page, click the Advanced Search drop-down arrow to the right of the search field to open the Advanced Search pane.
Enter the name of your Office 365 account store in the Account Store field and then either click the Search button or press ENTER.
Click X to close the Advanced Search pane.
Review the flow rules and make changes as needed by clicking the drop-down arrow to the right of the attribute whose flow rule you want to change and then select the appropriate flow rule from the drop-down menu.
After reviewing and making any needed changes to the attribute flow rules, return to the Office 365 Account Store Details screen in Configuration Manager.
From the Inventory pane, toggle the red sphere to the left of Enable Inventory to a green check box. This allows EmpowerID to inventory your Office 365 and create the appropriate user accounts and Person objects (when Person Provisioning is enabled for the account store) in EmpowerID.
If you are using the Account Inbox to provision or join the user accounts in the external directory to Empower Persons, you need to turn on the Account Inbox. This is demonstrated in the below section.
To enable the Account Inbox permanent workflow
From the Navigation Sidebar of the EmpowerID Web interface, expand Admin > EmpowerID Servers and Settings and click Permanent Workflows.
From the Permanent Workflows page, click the Display Name link for Account Inbox.
From the View One page for the workflow that appears, click the edit link for the workflow.
From the Permanent Workflow Details form that appears, select Enabled and then click Save. Based on the default settings applied to the workflow, EmpowerID will process 1000 of the user accounts in the Account Inbox every ten minutes, provisioning Person objects from those user accounts and joining them together based on the Join and Provision rules applied to the account store.
To monitor inventory
From navigation sidebar, expand System Logs > Policy Inbox Logs and click Account Inbox.
The Account Inbox page appears. This page provides tabbed views of all information related to processing new user accounts discovered in a connected account store during inventory. An explanation of these tabs follows.
Dashboard - This tab provides a quick summary of account inbox activity.
Not Processed - This tab displays a grid view of all inventoried user accounts not yet used to provision a new EmpowerID Person or joined to an existing Person. Any accounts that fail to meet the Join and Provision rules are displayed here as well.
Failed - This tab displays a grid view of any account joining or provisioning failures.
Ignored - This tab displays a grid view of all accounts ignored by the account inbox. Accounts are ignored if they do not qualify as user accounts.
Joined - This tab displays a grid view of all accounts joined to an EmpowerID Person. Joins occur based on the Join rules applied to the account store.
Processed - This tab displays a grid view of all accounts that have been used to either provision a new EmpowerID Person or joined to an existing EmpowerID Person.
Provisioned - This tab displays a grid view of all accounts that have been used to provision an EmpowerID Person. Provisioning occurs based on the Provision rules applied to the account store.
Orphans - This tab displays a grid view of all user accounts without an EmpowerID Person.
All - This tab displays a grid view of all user accounts and the status of those accounts in relation to the Account Inbox.