Questions about Automation in Active Directory On Premise Integration

Thanks a lot for this information :

user_principle_name: {{ticket.onboarding_request.actor_1.cf_first_initial}}{{ticket.onboarding_request.actor_1.cf_last_name}}companyname.com

It would be very nice from you to share your employee inboarding process.I’m in the same case : AD OnPremise, and O365 email account.

In case if a user OU is depending on a geographic location, is there a way to specify different OU (maybe multiple CONDITION ?).

Thanks again for your very quick help.

Kevin

Here is a overview screen shot of the create user workflow. (No Details)
 

Right click image attachment below and open in new tab. :)

How do you deal with employees who may have greater than 20 characters in their name? My organization uses firstname_lastname as the sAMAccount format. 

No, but my provisioning process still has that limitation in place, and i have many accounts that have been around since AD was first implemented here. 

Not knowing your exact use case….. In theory and a lot of work :) I think you could use the powershell orch.  You could issue a “New-RemoteMailbox” command calling the exchange powershell module from your local orch server.

IE, setup a orch server for powershell. Setup a workflow automation and call Import-Module ExchangeOnlineManagement and then your second command would me to Connect-ExchangeOnline and finally issue commands to build the boxes.

Of course I haven't tested this. In the past I have found a lot of little bugs with some of the orch modules that I report and they get fixed a month or so later. It’s possible you run into something like that during this journey.

I tried a quick test and ended up having to encase the complete PowerShell command in quotes. That makes sense as it has a space in it and passing that space has to be defined somehow.

 "Import-Module ExchangeOnlineManagement" - This works :)

A second option would be to right this in a native PowerShell script and then just feed variables from your onboarding module to the script via csv.

Thank you for prompt reply, we run enable-remotemailbox command within Exchange Shell on local hybrid server, will give it a try, thank you again

Hi @Madina 

Any update if you’ve successfully implemented this? Im currently exploring this right now :)

@mythumbsclick , how did you get this to work?  I’m just now starting to work on this for automating our onboarding tasks.  Would love to get more details.

@marqueza - I will summarise what we did so you can get a picture. Happy to provide more detail if required.

(Brace yourself, Its quite hacky)

• Setup a service account that the orchestration app Powershell is configured with.
• Service account has WINRM permissions on the Orchestration server (and the DC server via built in Remote Management Users)
• Via GP deny interactive logins to domain for extra security
• On the orchestration server, Allow the service account to write to the application event log using (SDDL) string - Link (pushed via GP). This was a learning Curve!
• Next create folder on the orchestration server with NTFS permissions that the service account can write to
• Have the following script that will Enable-RemoteMailbox

$User = "domain\TEST.USER"
$UserRemoteRoutingAddress = "TEST.USER@testdomain.mail.onmicrosoft.com"

$credential = Import-CliXml -Path "E:\somepath\Freshservice\encryptedcreds.xml"
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://azexch/powershell/ -Credential $credential

Import-PSSession $Session
Enable-RemoteMailbox $User -RemoteRoutingAddress $UserRemoteRoutingAddress

• Setup a GMSA
• Use PSEXEC to run powershell as GMSA and create the credential xml file referenced in the above powershell script. The cred file HAS to be created by the GMSA.
• Next create a scheduled task run by the GMSA on the orchestration server that is triggered on an event number of your choosing. Example:
  • Log: Application
  • Source: Freshservice Orchestration
  • Event ID: 3001
• The action of the above task is: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -File "E:\SomePath\Enable Remote Mailbox Automation.ps1"
• Now in The work flow in Freshservice create an App action in the onboarding new user flow
• App - Powershell Orch
• Payload:

#Path of enable remote mailbox script
$file = "E:\SomePath\Enable Remote Mailbox Automation.ps1"

#read content of script
$content = Get-Content -Path $file

#rewrite the first line of the script with Freshservice placeholder contents for firstname and surname
$content[0] = '$User = "Domain\{{ticket.onboarding_request.actor_1.cf_employee_name}}.{{ticket.onboarding_request.actor_1.cf_employee_surname}}"'

#rewrite the second line of the script with Freshservice placeholder contents
$content[1] = '$UserRemoteRoutingAddress = "{{ticket.onboarding_request.actor_1.cf_employee_name}}.{{ticket.onboarding_request.actor_1.cf_employee_surname}}@testdomain.mail.onmicrosoft.com"'

#write the changes back
$content | Set-Content -Path $file

#trigger the event log that will in turn trigger the scheduled task that will then run the Enable Remote mailbox script using the GMSA account (and credentials file)
Write-EventLog -LogName "Application" -Source "Freshservice Orchestration" -EventID 3001 -EntryType Information -Message "Freshservice ran a Enable-RemoteMailbox work flow for new user {{ticket.onboarding_request.actor_1.cf_employee_name}}.{{ticket.onboarding_request.actor_1.cf_employee_surname}}." -Category 1 -RawData 10,20

I think that just about covers it. It works well for us albeit a bit long winded but its the only decent way we could figure out how to do this and keep everything secure. I avoided storing secure credentials in the work flow for example.