Search for a command to run...
a.k.a solution for Exchange hybrid environments orphaned mailbox problem
I work as System Administrator for more than 15 years now and I love to make my life easier by automating work & personal stuff via PowerShell (even silly things like food recipes list generation).
No comments yet. Be the first to comment.
Or any other Azure service requiring special authentication strength
If you are using Azure Local (HCI), you might find the following PowerShell script AzureLocalVMImageUpdater.ps1 useful. What is it good for? The code replaces the Windows VM images in the specified Azure Local cluster(s) with the latest compatible ve...
Problem It happens that the hardware hash of your Autopilot device gets changed. Thanks to the replacement of the motherboard or some other issue. This can lead to future problems when your users need to reinstall the operating system, but the Autopi...
Learn how to use undocumented Azure APIs for massive performance gains
Keeping a secure, version-controlled backup of your Intune-managed device data, including BitLocker, LAPS, and FileVault keys, is a best practice for any modern IT team. In this post, I’ll guide you through an Azure DevOps pipeline that automates the...
We have local AD synced to AzureAD and an on-premises Exchange server for expanding AD schema (mailboxes are hosted in Office 365 Exchange Online). In other words, hybrid Exchange environment.
From time to time, when we deprovision employee mailbox using Disable-Mailbox command we encounter an error: "Microsoft.Exchange.Configuration.DualWrite.LocStrings.UnableToWriteToAadException: An Azure Active Directory call was made to keep object in sync between Azure Active Directory and Exchange Online. However, it failed. Detailed error message: Unable to update the specified properties for on-premises mastered Directory Sync objects or objects currently undergoing migration.". It is the same problem as described on Reddit where I've also found the solution for fixing this problem. But I hate manual work, so I've created PowerShell function Remove-O365OrphanedMailbox (part of O365Stuff module) to solve this issue.
Remove-O365OrphanedMailbox function will:
- move user account to OU that is not synchronized to AzureAD
- initialize dir-sync, so the user account gets deleted in AzureAD
- restore a user in AzureAD, but now it is not dir-synced i.e. we can modify it in AzureAD
- remove litigation hold settings
- remove user mailbox
- clear user connection-with-mailbox data
- clear immutableId
- move the account to the original OU
- attach on-premises account with AzureAD account
Therefore you have to run it with appropriate permissions!
Install-Module O365Stuff
Import-Module O365Stuff
Remove-O365OrphanedMailbox -samAccountName <problematicMailbox> -notSyncedOUDN <DistinguishedNameToOUNotSyncedTOAAD>
Have fun 👍