Exchange Connector

Overview

The Exchange PowerShell connector is used to enable mailboxes for users in on-premises Exchange and in Exchange Online. For Exchange on-premises, it supports Exchange 2010 and newer.

Conceptual Architecture

The Exchange PowerShell connector is using LDAP to read data from Active Directory and Remote PowerShell to manage mailboxes in Exchange. You will need an on-premises Exchange management server when you want to manage accounts in Exchange Online.

Connector Capabilities

The connector has support for the following:

• Full and delta Import with support for confirming import
• Paging support for Import
• Renames in delta import
• Export
• Partitions and Hierarchies
• Uses Enable-Mailbox, Enable-RemoteMailbox, and Disable-Mailbox

The connector can create mailboxes both on add and update. That is, you can take an existing account and set an attribute to create a mailbox, or provision a new object into the connector space to enable a mailbox on an existing AD object (but not yet imported).

Pre-requisites

The account used by the connector must have:

• The Active Directory permission Replicating Directory Changes for delta import to work.
• Member of the group Recipient Management.

Connector Space Design

The schema for the Exchange PowerShell connector is using one object type named User. It has the following attributes:

Attribute	Description
ObjectGUID	The AD objectGUID. Used as the anchor in the connector.
_isMailboxEnabled	Boolean. Indicates if the user has a mailbox. Import only.
_MailboxType	String. Set this attribute to Mailbox or RemoteMailbox to provision a mailbox. If created correctly in Exchange, then the confirming import will provide the mailbox type. Remove the value to disable the mailbox.
dn	The AD DistinguishedName attribute. Required on provisioning new objects.
mailNickName	The alias attribute in Exchange, stored as mailNickName in AD by Exchange.
sAMAccountName	Useful attribute to join on. Import only.

Implementation details

During import the connector first reads all objects in AD to memory and then pages them to the sync engine. For this reason, it will keep the objects count to 0 in the sync engine UI for a while until all relevant objects in AD have been imported.

Due to limitations in the PowerShell connector it is not possible to remove an attribute value during delta import. A full import is required to remove these. For example, when a mailbox is removed the mailNickname attribute still has a value in the connector space.