IBM Security Verify Governance Adapter
v10.0.15 for Microsoft Office 365 is available.
Compatibility, installation and other getting-started issues are addressed.
Copyright International Business
Machines Corporation 2022, 2024. All rights reserved.
US Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.
Welcome to the IBM Security Verify Governance Adapter for Microsoft Office 365.
The Microsoft Office 365 Adapter is designed to create and manage User Accounts on the Microsoft Office 365 domain. The adapter runs in "agentless" mode and communicates using the Graph API to the Microsoft Office 365 Domain being managed.
The IBM Security Verify Governance Adapters are powerful tools that require Administrator Level authority. Adapters operate much like a human system administrator, creating accounts, permissions, and home directories. Operations requested from the IBM Security Verify Governance Identity Manager server and IBM Security Verify Governance server will fail if the Adapter is not given sufficient authority to perform the requested task .
Review and agree to the terms of the IBM Security Verify Governance Adapter License prior to using this product. The license can be viewed from the "license" folder included in the product package.
Adapter Version
|
Component |
Version |
|
Build Date |
2026 March 26 07.37.18 |
|
Adapter Version |
10.0.15 |
|
Component Versions |
Adapter build: 10.0.15.2 Profile: 10.0.15.2 Connector: 10.0.15.2 Dispatcher 7.1.39 or higher (packaged separately) |
|
Documentation |
The following guides will be made available in the IBM Verify Governance Adapters Knowledge Center · Microsoft Office 365 Adapter Installation and Configuration Guide |
|
Internal# |
Enhancement # (RFE / IDEA) |
Description |
|
|
|
Items included in 10.0.15 current release |
|
SVGAD-6090 |
ADAPT-249 |
Certify the adapter for use with IBM Verify Directory Integrator version 11.x |
|
|
|
Items included in 10.0.14 release |
|
|
|
None |
|
|
|
Items included in 10.0.13 release |
|
SVGAD-4276 |
ADAPT-190 |
Support filtering specified on Service for fetching user accounts |
|
SVGAD-4115 |
ADAPT-194 / ISIM-I-5076
|
Managing Distribution Lists and Mail Enabled Security Groups |
|
|
|
Items included in 10.0.12 release |
|
|
|
None |
|
|
|
Items included in 10.0.11 release |
|
SVGAD-2221 |
ADAPT-160 |
Add role-assignable groups property to O365Adapter Group, See Installation Guide > reference > From Default Group Attributes table for more details. For errors, refer troubleshooting > Error messages and problem solving. |
|
Items included in 10.0.10 release |
||
|
|
|
|
|
SVGAD-2030 |
ISIM-I-5036 |
Office 365 Adapter should support custom and inactive roles |
|
SVGAD-1881 |
IDEA ADAPT-137 |
Implemented Adapter such that it facilitate user to sync Groups from: 1) (Default) Only Azure Active Directory. 2) Groups form Azure Active Directory and Active Directory. (If ISVG and Identity Manager in hybrid AD/AzureAD environment with AD Sync synchronization enabled.) With Default Option Adapter will ignore (not Sync) Groups on AAD account that are synchronized from AD to avoid modifying of Active Directory Group Objects which are read only objects.
|
|
SVGAD-2106 |
|
Properties file update for additional
Attributes. Additional Attributes of the Office365 Adapter need to be listed
with additionalAttributes key
as mentioned below: additionalAttributes=createdDateTime,ageGroup,businessPhones,companyName,consentProvidedForMinor,creationType,employeeHireDate,employeeId,employeeType,legalAgeGroupClassification,lastPasswordChangeDateTime,onPremisesDistinguishedName,onPremisesDomainName,onPremisesLastSyncDateTime,onPremisesSamAccountName,onPremisesSecurityIdentifier,onPremisesSyncEnabled, onPremisesUserPrincipalName,passwordPolicies,preferredDataLocation,securityIdentifier,signInSessionsValidFromDateTime,manager,mailboxSettings,mailboxSettings_FULLSUPPORT,manager_FULLSUPPORT Properties file location updated to : <SDI_Solution_Directory>\properties\Office365-Attributes.properties
|
|
|
|
|
|
|
ADAPT-104 / ADAPT-I-167 |
|
|
|
ADAPT-134 / ADAPT-128 / ADAPT-125 / ADAPT-98 |
|
|
|
ADAPT-104 / IGI-I-524 |
|
|
|
|
Items included in release (10.0.8) |
|
SVGAD-342 |
ADAPT-98 / ADAPT-I-1 / ADAPT-I-202 |
ImmutableId should be editable |
|
|
|
Items included in release (10.0.7) |
|
|
|
None |
|
|
|
Items included in release (10.0.6) |
|
|
|
None |
|
|
|
Items included in release (10.0.5) |
|
Internal |
|
Internal O365 - Some attributes missing. |
|
|
|
Items included in release (10.0.4) |
|
RTC – 188949 |
|
Internal O365 - License not removed for user account in O365 admin centre |
|
|
|
Items included in release (10.0.3) |
|
RTC – 189673 |
|
Internal O365 - Adapter Refresh Azure Graph API to MS Graph API changes |
|
|
|
Items included in release (10.0.2) |
|
|
|
None |
|
|
|
Items included in release (10.0.1) |
|
|
|
None |
|
|
|
Items included in release (7.1.17) |
|
|
|
None |
|
|
|
Items included in release (7.1.16) |
|
TS002767617 |
|
|
|
|
|
Items included in release (7.1.15) |
|
|
|
|
|
|
|
Items included in release (7.1.14) |
|
|
|
|
|
|
|
Items included in release (7.1.13) |
|
|
|
None
|
|
|
|
Items included in release (7.1.12) |
|
|
|
None
|
|
|
|
Items included in release (7.1.11) |
|
|
|
None
|
|
|
|
Items included in 7.1.10 release |
|
|
167912 |
Office 365 Roles and Office 365 Licenses appear as Service Groups.
|
|
|
|
Items included in 7.1.9 release |
|
|
154064 |
Roles are dynamically populated for the given tenant via tha API when creating or modifying a user.
|
|
|
|
Items included in 7.1.8 release |
|
|
|
Add
support for IGI 5.2.2
|
|
|
|
Items included in 7.0.7 release |
|
|
43248 (143742) |
Support user provisioning in Federated domain
|
|
|
39329 (143742) |
Adapter should manage ObjectGUID attribute - ImmutableID
|
|
|
|
Items included in 7.0.6 release |
|
|
137482 |
Configurable Search Page size parameter added in account form.
|
|
|
|
Items included in 7.0.5 release |
|
|
131866 |
Upgraded to Graph API version 1.6, support to the latest version provided by Microsoft.
|
|
|
|
Items included in 7.0.4 release |
|
|
|
Initial Release
|
Closed Issues
|
Internal# |
Known Issue# / CASE# |
Description |
|
|
|
Items closed in 10.0.15 current release |
|
Bug 4343 / SVGAD-2394
|
TS016213757 KI: DT459321
|
Adapter giving timeout after 2 hours in filter recon. |
|
|
|
Items closed in 10.0.14 release |
|
Bug 4601 / SVGAD-5083
|
TS019729914 KI: DT455021
|
Not able to create federated domain user. |
|
|
|
|
|
Bug 4462 / SVGAD-4127 |
TS017014396 KI: DT421317 |
|
|
Bug 4486 / SVGAD-4124 |
TS017958504 KI: DT434365 |
|
|
SVGAD-3959 |
|
Recon process change to retrieve associated groups of the members based on number of users and groups |
|
Bug 4487 / SVGAD-4131 |
TS018389418 |
Concurrent Group Update Requests from ISIM/IGI to Adapter not getting processed as expected |
|
SVGAD-4312 |
|
The adapter supports each user to enroll in 999 group only and 999 roles only, not beyond that. |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
SVGAD-2441 |
KI: DT381609 / TS015220425 |
Full Recon some groups are not being synced with associated members |
|
|
|
Items closed in release (10.0.10)
|
|
SVGAD-2108 |
|
Performance improvement of Office365 Adapter
Performance enhancement of Full Recon. This is a fix which provide support of endsWithFilter on eruid (User Principal Name) only, which is also a part of performance enhancement. Microsoft document for filter - https://learn.microsoft.com/en-us/graph/filter-query-parameter?tabs=http. EndsWithFilter reconciliation support filtered user data. (* must be at first place only like given example) EndsWithFilter Example : (eruid=*@ibm.com) or (eruid=*abc@ibm.com) or (eruid=*@consultant.ibm.com) For below cases endsWithFilter with eruid will not work on API : 1. more than one * in the filter 2. * is not appears at first place like (eruid=abc*@ibm.com)
|
|
|
|
|
|
|
|
|
|
|
|
Items closed in release (10.0.8)
|
|
|
|
None
|
|
|
|
Items closed in release (10.0.7)
|
|
Bug 3837 RTC-190666
|
TS009134208 |
O365 Password Not Changing. |
|
Bug 3977 RTC-191075
|
TS010901559 |
Office365 adapter doesn't gather all the resources. |
|
Bug 3920 RTC-190849
|
TS010027977 |
O365 service test connection. |
|
Bug 3971 RTC-191048
|
TS010758200 |
Nullpoiner exception attempgin to modify accounts. |
|
RTC-191279
|
wrong oid used for O365 attribute. |
|
|
Bug 3926 RTC-190967
|
TS010174228 |
Question on IBM Security Verify Adapter for Microsoft Office 365. |
|
|
|
Items closed in release (10.0.6)
|
|
Bug 3841 RTC-190591
|
|
Office365 Connector - Issue when creating an account. |
|
|
|
Items closed in release (10.0.2)
|
|
Bug 3413 RTC-188098
|
|
O365 Reconciliation always return the user dump. |
|
|
|
Items closed in release (10.0.1)
|
|
Bug 3205 RTC-186971
|
|
IGI - Office 365 Adapter - error when removing permissions and synchronizing |
|
|
|
|
|
|
|
Items closed in release (7.1.17)
|
|
Bug 3192 RTC-186987
|
|
O365 addUser fails with “SourceAnchor is a required property for creation of a federated user. |
|
|
|
Items closed in release (7.1.16)
|
|
|
|
|
|
|
|
Items closed in release (7.1.15)
|
|
|
IJ20971 |
|
|
RTC-185424 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
RTC-184344 |
|
Office 365 code clean-up and handling exceptions correctly, follow-up for Bugs 2816 |
|
|
|
|
|
|
|
Items closed in release (7.1.13)
|
|
Bug 2866 RTC-183802
|
|
Office365 unable to provision license |
|
Bug 2882 RTC-183801 |
|
Plan id is same as sku id when no. of plan ids is 1
|
|
Bug 2885 RTC -183478
|
|
Issues with immutableid attributes
|
|
Bug 2909 RTC-183806 |
|
O365 filtered recons
|
|
Bug 2916 RTC-183805
|
|
adapter hangs when deleting an account that does not exist on O365 |
|
|
|
Office365 recon failure - adapter is unable to recon large data |
|
|
|
Items closed in release (7.1.12)
|
|
181613
|
|
Facing issue while performing Change Password operation for Office365 adapter on IGI 5.2.5. |
|
180753
|
TS001074802 / IJ11132
|
Modified the GetGroupMembership REST request. Added parameter to fetch defined number of entries from the resource.
|
|
181527 |
|
Internal - As an Office 365 adapter, I must ensure that the dn target attribute should be mapped to dn governance attribute by default
|
|
|
|
Items closed in release (7.1.11)
|
|
172672 |
TS000109852 / IJ04343 |
The Recon doesn't terminate automatically in IGI 5.2.3.1
|
|
|
|
Items closed in 7.1.10 release
|
|
|
|
None
|
|
|
|
Items closed in 7.1.9 release
|
|
154064 |
|
The 'directoryRoles' segment is used to manage roles instead of 'roles' and objectId to reference roles. This is due to a change in Microsoft API.
|
|
154151 |
75579,082,000 |
The license removal needs an explicit call to remove the SKU in case no service plans are enabled. This is due to a change in Microsoft API.
|
|
|
|
Items closed in 7.1.8 release
|
|
|
|
Initial Release compliant with IGI 5.2.2
|
|
|
|
Items closed in 7.0.6 release
|
|
136441 |
|
The list of available license service plans should return licenses that are enabled for provisioning applicable for provisioning at user level.
|
|
136435 |
|
App Key is masked in the Debug log
|
|
|
|
Items closed in 7.0.5 release
|
|
132680 |
|
The App key is hidden in service form. The attribute "ero365appkey" is added in password.attributes list in enRole.properties in <ISIM_HOME>/data directory.
|
|
|
|
Items closed in 7.0.4 release
|
|
|
|
Initial release.
|
|
Internal# |
APAR# / CASE# |
Description |
|
N/A |
N/A |
Attributes that require an SharePoint Online (SPO) license are not supported in the current release of the adapter.
|
|
N/A |
N/A |
Attributes and/or operations that are not supported in the production version of Microsoft Graph API are not supported in the adapter.
|
|
N/A |
N/A |
Currently, we don't support
"Directory (Azure AD) extensions" attributes called also as the
custom attributes indicated in this document: |
|
N/A
|
N/A
|
The adapter doesn't support deletion of all mails in otherMails attribute in case of ISVG.
|
|
N/A |
N/A |
User Principal Name is ReadWrite Attribute. It is not recommended to update User Principal Name from target as after reconciliation new user will be created and you need to associate user manually again for that user. Always prefer to update User Principal Name from ISIM/IGI to maintain consistency.
|
|
N/A |
N/A |
|
|
N/A |
N/A |
The adapter does not support duplicated Group Display Name.
|
|
N/A |
N/A |
The adapter does not support change of Group Name. This is a limitation of the IBM Security Verify Manager. Attempting to change the Group Name will result in the following error: " CTGIMI046E You cannot change the value of the attribute that is mapped to ergroupname."
|
|
N/A |
N/A |
The service principal that represents the adapter service must be in an administrator role that has permissions to modify role objects to send POST or DELETE requests. It must be in a role that has permissions to read role objects to send GET requests. For more information about administrator roles in Windows Azure AD Graph, see Windows Azure AD Graph and Role-Based Access Control. http://msdn.microsoft.com/en-us/library/azure/dn385717.aspx
|
|
N/A |
N/A |
Microsoft has a limitation that user accounts cannot be added or modified in a federated domain from an on-premise Dir Sync Active Directory, which is not the default domain. Provisioning of users in such domain can be done by using the AD adapter and then syncing it back to the Azure Directory using the Microsoft DirSync tool.
|
|
N/A |
N/A |
The "Enable detailed TDI debugging" on the Service Form has been removed from 7.0.2 release due to security reasons. Instead, "DEBUG" in the ITDI log4j.properties file is to be used to enable extra debug logging.
|
|
SVGAD-4628 |
N/A |
Exchange Online feature is not supported with containerized installation of adapter.
|
See the IBM Security Verify Governance Adapter Installation and Configuration Guide for detailed instructions.
Corrections to Installation guide:
Chapter 1: Overview
Nothing to update
Chapter 2: Planning
Nothing to update
Chapter 3: Installing
Nothing to update
Chapter 4: Upgrading
Chapter 5: Configuring
Nothing to update
Chapter 6: Troubleshooting
Error messages and problem solving
Add below error in Table1
|
Problem |
Corrective Action |
|
Reconciliation takes more than 24 hours. Or Reconciliation failed after 24 hours. |
Use Users Endpoint Filter Query at service level to filter out users and create more than one services of Adapter to fetch full set of data. |
|
|
|
Chapter 7:
Reference
Nothing to
Update
Installation Platform
The IBM Security Verify Governance Adapter for was built and tested on the following product versions.
Adapter Installation Platform:
Due
to continuous Java security updates that may be applied to your IBM Security
Verify Governance server and IBM Security Verify Governance Identity Manager
server, the following SDI releases are the officially supported versions:
- Security
Directory Integrator 7.2 + FP14
- IBM Verify Directory Integrator 11.0.0
- Security Verify Directory Integrator 10.0.0 + FP05
Note: Earlier versions of SDI that are still supported may function properly, however to resolve any communication errors, you must upgrade your SDI releases to the officially supported versions by the adapters. Please refer to the adapter's installation and configuration guides for the latest update on IBM Security Directory Integrator versions and fix packs
Managed Resource:
Office 365 supported HTTP Client component:
- Apache HTTP Component Client
- Powershell 7.5.0
- Exchange Online Module v3.0
3rd Party Client Libraries:
httpclient-4.5.14.jar
Download the httpclient-4.5.14.jar from
https://mvnrepository.com/artifact/org.apache.httpcomponents/httpclient/4.5.14
httpcore-4.4.16.jar
Download the httpcore-4.4.16.jar from
https://mvnrepository.com/artifact/org.apache.httpcomponents/httpcore/4.4.16
commons-logging-1.2.jar
Download the commons-logging-1.2.jar from
https://mvnrepository.com/artifact/commons-logging/commons-logging/1.2
Supported IBM Security Verify Governance servers:
· IBM Verify Identity Governance v11.0
· IBM Security Verify Governance Identity Manager v10.0*
· IBM Security Verify Governance v10.0
* Unless this document specifies a specific fix pack version of ISVG Identity Manager v10, we expect the adapter to work with ISIM 6 as well. However, it will only be debugged and fixed from the perspective of ISVG-IM v10.
This information was developed for products and
services offered in the U.S.A. IBM may not offer the products, services, or
features discussed in this document in other countries. Consult your local IBM
representative for information on the products and services currently available
in your area. Any reference to an IBM product, program, or service is not
intended to state or imply that only that IBM product, program, or service may
be used. Any functionally equivalent product, program, or service that does not
infringe any IBM intellectual property right may be used instead. However, it
is the user's responsibility to evaluate and verify the operation of any
non-IBM product, program, or service.
IBM may have patents or pending patent applications covering subject matter
described in this document. The furnishing of this document does not give you
any license to these patents. You can send license inquiries, in writing, to:
IBM
Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785 U.S.A.
For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to:
Intellectual
Property Licensing
Legal and Intellectual Property Law
IBM Japan, Ltd.
1623-14, Shimotsuruma, Yamato-shi
Kanagawa 242-8502 Japan
This information could include technical inaccuracies or
typographical errors. Changes are periodically made to the information herein;
these changes will be incorporated in new editions of the publication. IBM may
make improvements and/or changes in the product(s) and/or the program(s)
described in this publication at any time without notice.
Any references in this information to non-IBM Web sites are provided for
convenience only and do not in any manner serve as an endorsement of those Web
sites. The materials at those Web sites are not part of the materials for this
IBM product and use of those Web sites is at your own risk.
IBM may use or distribute any of the information you supply in any way it
believes appropriate without incurring any obligation to you.
Licensees of this program who wish to have information about it for the purpose
of enabling: (i) the exchange of information between independently created
programs and other programs (including this one) and (ii) the mutual use of the
information which has been exchanged should contact:
IBM
Corporation
2ZA4/101
11400 Burnet Road
Austin, TX 78758 U.S.A.
Such information may be available, subject to
appropriate terms and conditions, including in some cases, payment of a fee.
The licensed program described in this information and all licensed material
available for it are provided by IBM under terms of the IBM Customer Agreement,
IBM International Program License Agreement, or any equivalent agreement
between us.
Any performance data contained herein was determined in a controlled
environment. Therefore, the results obtained in other operating environments
may vary significantly. Some measurements may have been made on
development-level systems and there is no guarantee that these measurements
will be the same on generally available systems. Furthermore, some measurements
may have been estimated through extrapolation. Actual results may vary. Users
of this document should verify the applicable data for their specific
environment.
Information concerning non-IBM products was obtained from the suppliers of
those products, their published announcements or other publicly available
sources. IBM has not tested those products and cannot confirm the accuracy of
performance, compatibility or any other claims related to non-IBM products.
Questions on the capabilities of non-IBM products should be addressed to the
suppliers of those products.
Trademarks
IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of
International Business Machines Corp., registered in many jurisdictions
worldwide. Other product and service names might be trademarks of IBM or other
companies. A current list of IBM trademarks is available on the Web at
"Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml.
Microsoft, Windows, and the Windows logo are trademarks of Microsoft
Corporation in the United States, other countries, or both.
Java and all Java-based trademarks and logos are trademarks or registered
trademarks of Oracle and/or its affiliates.