Release notes - IBM Security Verify Governance Adapter v10.0.15 for Microsoft Office 365

IBM Security Verify Governance Adapter v10.0.15 for Microsoft Office 365 is available. Compatibility, installation and other getting-started issues are addressed.

Copyright International Business Machines Corporation 2022, 2024. All rights reserved.

US Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

Contents

 

Preface

Welcome to the IBM Security Verify Governance Adapter for Microsoft Office 365.

 

Adapter Features and Purpose

 

The Microsoft Office 365 Adapter is designed to create and manage User Accounts on the Microsoft Office 365 domain. The adapter runs in "agentless" mode and communicates using the Graph API to the Microsoft Office 365 Domain being managed.

 

The IBM Security Verify Governance Adapters are powerful tools that require Administrator Level authority. Adapters operate much like a human system administrator, creating accounts, permissions, and home directories. Operations requested from the IBM Security Verify Governance Identity Manager server and IBM Security Verify Governance server will fail if the Adapter is not given sufficient authority to perform the requested task .

 

License Agreement

Review and agree to the terms of the IBM Security Verify Governance Adapter License prior to using this product. The license can be viewed from the "license" folder included in the product package.

Contents of this Release

Refer to the KC link IBM Security Verify Governance Adapter Development and Customization Guide 

Adapter Version

Component

Version

Build Date

2026 March 26 07.37.18

Adapter Version

10.0.15

Component Versions

Adapter build: 10.0.15.2

Profile:  10.0.15.2

Connector:  10.0.15.2

Dispatcher 7.1.39 or higher (packaged separately)

Documentation

The following guides will be made available in the IBM Verify Governance Adapters Knowledge Center

·  Microsoft Office 365 Adapter Installation and Configuration Guide

New Features

Internal#

Enhancement # (RFE / IDEA)

Description

 

 

Items included in 10.0.15 current release

 

SVGAD-6090

 

ADAPT-249

Certify the adapter for use with IBM Verify Directory Integrator version 11.x

 

 

Items included in 10.0.14 release

 

 

None

 

 

Items included in 10.0.13 release

 

SVGAD-4276

 

ADAPT-190

Support filtering specified on Service for fetching user accounts

 

SVGAD-4115

 

ADAPT-194 / ISIM-I-5076

 

Managing Distribution Lists and Mail Enabled Security Groups

 

 

Items included in 10.0.12 release

 

 

None

 

 

Items included in 10.0.11 release

 

SVGAD-2221

 

ADAPT-160

Add role-assignable groups property to O365Adapter Group,

See Installation Guide >  reference > From Default Group Attributes table for more details.

For errors, refer troubleshooting > Error messages and problem solving.

Items included in 10.0.10 release


SVGAD-1727


ADAPT-149


Certify the adapter for use with IBM Security Verify Directory Integrator version 10.0.0

 

SVGAD-2030

 

ISIM-I-5036

Office 365 Adapter should support custom and inactive roles

 

 

SVGAD-1881

 

 

IDEA ADAPT-137

 

Implemented Adapter such that it facilitate user to sync Groups from:

1) (Default) Only Azure Active Directory.

2) Groups form Azure Active Directory and Active Directory. (If ISVG and Identity Manager in hybrid AD/AzureAD environment with AD Sync synchronization enabled.)

With Default Option Adapter will ignore (not Sync) Groups on AAD account that are synchronized from AD to avoid modifying of Active Directory Group Objects which are read only objects.

 

SVGAD-2106

 

Properties file update for additional Attributes. Additional Attributes of the Office365 Adapter need to be listed with additionalAttributes key as mentioned below:

additionalAttributes=createdDateTime,ageGroup,businessPhones,companyName,consentProvidedForMinor,creationType,employeeHireDate,employeeId,employeeType,legalAgeGroupClassification,lastPasswordChangeDateTime,onPremisesDistinguishedName,onPremisesDomainName,onPremisesLastSyncDateTime,onPremisesSamAccountName,onPremisesSecurityIdentifier,onPremisesSyncEnabled, onPremisesUserPrincipalName,passwordPolicies,preferredDataLocation,securityIdentifier,signInSessionsValidFromDateTime,manager,mailboxSettings,mailboxSettings_FULLSUPPORT,manager_FULLSUPPORT

Properties file location updated to : <SDI_Solution_Directory>\properties\Office365-Attributes.properties

 

 


Items closed in 10.0.9 release


SVGAD-117

ADAPT-104 / ADAPT-I-167


ISVG Office 365 Adapter - Roles as entitlements/permissions.


SVGAD-495

ADAPT-134 / ADAPT-128 / ADAPT-125 / ADAPT-98


Refresh O365 adapter.

1. Added Support for Additional On-Premises Group Attributes. See chapter,Table 4. Supported On-premise Group Attributes
2. Added support for the standard Azure user attributes as documented in the properties table: https://learn.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0#properties with the exception of the attributes that require SPO license: aboutMe,birthday,hireDate,interests,mySite,pastProjects,preferredName,responsibilities,schools,skills, showInAddressList. See chapter,Table 2. Additional User Attributes
3. Added support for Guest account. See chapter,Adapter attributes by operations
4. Added support of MailboxSettingsTable.See chapter,MailboxSettings Attributes


SVGAD-207

ADAPT-104 / IGI-I-524


ISVG Office 365 Adapter - Additional attributes provisioning.
Employee ID
Manager
Company Name
OfficeLocation
Proxy Address

 

 

 

Items included in release (10.0.8)

 

SVGAD-342

ADAPT-98 / ADAPT-I-1 / ADAPT-I-202

 

ImmutableId should be editable

 

 

 

Items included in release (10.0.7)

 

 

 

None

 

 

 

Items included in release (10.0.6)

 

 

 

None

 

 

 

Items included in release (10.0.5)

 Internal

 

 

Internal O365 - Some attributes missing.

 

 

 

Items included in release (10.0.4)

 RTC – 188949

 

 

Internal O365 - License not removed for user account in O365 admin centre

 

 

 

Items included in release (10.0.3)

 RTC – 189673

 

 

Internal O365 - Adapter Refresh Azure Graph API to MS Graph API changes

 

 

 

Items included in release (10.0.2)

 

 

 

None

 

 

 

Items included in release (10.0.1)

 

 

 

None

 

 

 

Items included in release (7.1.17)

 

 

 

None

 

 

 

Items included in release (7.1.16)


Bug 3052
RTC 185476

TS002767617


RFE – 137533 (60119)


IBM IGi - Office 365 Add-on License Support

 

 

 

Items included in release (7.1.15)

 

 


None

 

 

 

Items included in release (7.1.14)

 

 


None

 

 

 

Items included in release (7.1.13)

 

 

 

None

 

 

 

 

Items included in release (7.1.12)

 

 

 

None

 

 

 

 

Items included in release (7.1.11)

 

 

 

None

 

 

 

 

Items included in 7.1.10 release

 

 

167912

 

Office 365 Roles and Office 365 Licenses appear as Service Groups.

 

 

 

 

Items included in 7.1.9 release

 

 

154064

 

Roles are dynamically populated for the given tenant via tha API when creating or modifying a user.

 

 

 

 

Items included in 7.1.8 release

 

 

 

Add support for IGI 5.2.2
This adapter is now designed for use with IBM Security Identity Manager, Privileged Identity Manager, and Identity Governance and Intelligence.
.

 

 

 

 

Items included in 7.0.7 release

 

 

43248 (143742)

 

Support user provisioning in Federated domain

 

 

 

39329 (143742)

 

Adapter should manage ObjectGUID attribute - ImmutableID

 

 

 

 

Items included in 7.0.6 release

 

 

137482

 

Configurable Search Page size parameter added in account form.

 

 

 

 

Items included in 7.0.5 release

 

 

131866

 

Upgraded to Graph API version 1.6, support to the latest version provided by Microsoft.

 

 

 

 

Items included in 7.0.4 release


Internal

 

 

Initial Release

 

Closed Issues

Internal#

Known Issue# / CASE#

Description

 

 


Items closed in 10.0.15 current release

Bug 4343 / SVGAD-2394

 

TS016213757

KI: DT459321

 

Adapter giving timeout after 2 hours in filter recon.

 

 


Items closed in 10.0.14 release

Bug 4601 / SVGAD-5083

 

TS019729914

KI: DT455021

 

Not able to create federated domain user.

 

 


Items closed in 10.0.13 release

Bug 4462 / SVGAD-4127

TS017014396

KI: DT421317


Guest user can not be assigned as a manager in AzureAD Adapter.

Bug 4486 / SVGAD-4124

TS017958504

KI: DT434365


"Too many request" Error. Refer to Troubleshooting > Error message and problem solving section for more infomation.

SVGAD-3959

 

 

Recon process change to retrieve associated groups of the members based on number of users and groups

Bug 4487 / SVGAD-4131

TS018389418
KI: DT435016

Concurrent Group Update Requests from ISIM/IGI to Adapter not getting processed as expected

SVGAD-4312

 

The adapter supports each user to enroll in 999 group only and 999 roles only, not beyond that.

 


Items closed in release (10.0.12)


SVGAD-3255



KI: DT399959 / TS017523784



Immutable ID can not be modified.

 


Items closed in release (10.0.11)


SVGAD-2343



KI: DT378946 / TS015959071



Issue with Office365 filter reconcile being case sensitive from service.def file setup.

 SVGAD-2441

KI: DT381609 / TS015220425

Full Recon some groups are not being synced with associated members

 

 

 

Items closed in release (10.0.10)

 

 

SVGAD-2108

 

 

Performance improvement of Office365 Adapter

 

Performance enhancement of Full Recon.

This is a fix which provide support of endsWithFilter on eruid (User Principal Name) only, which is also a part of performance enhancement.

Microsoft document for filter - https://learn.microsoft.com/en-us/graph/filter-query-parameter?tabs=http.

EndsWithFilter reconciliation support filtered user data. (* must be at first place only like given example)

EndsWithFilter Example : (eruid=*@ibm.com)  or  (eruid=*abc@ibm.com)  or  (eruid=*@consultant.ibm.com)

For below cases endsWithFilter with eruid will not work on API  :

1. more than one * in the filter

2. * is not appears at first place like (eruid=abc*@ibm.com)

 

 

 

 


Items closed in 10.0.9 release


SVGAD-1104



Resolve BrokerageDriver: unable to get group error in IGI for MS Office 365 adapter.

 

 

 

Items closed in release (10.0.8)

 

 

 

 

None

 

 

 

 

Items closed in release (10.0.7)

 

 

Bug 3837

RTC-190666

 


TS009134208

 

O365 Password Not Changing.

 

Bug 3977

RTC-191075

 


TS010901559

 

Office365 adapter doesn't gather all the resources.

 

Bug 3920

RTC-190849

 


TS010027977

 

O365 service test connection.

 

Bug 3971

RTC-191048

 


TS010758200

 

Nullpoiner exception attempgin to modify accounts.

 

RTC-191279

 


 

wrong oid used for O365 attribute.

 

Bug 3926

RTC-190967

 


TS010174228

 

Question on IBM Security Verify Adapter for Microsoft Office 365.

 

 

 

Items closed in release (10.0.6)

 

 

Bug 3841

RTC-190591

 


TS009094438

 

Office365 Connector - Issue when creating an account.

 

 

 

Items closed in release (10.0.2)

 

 

Bug 3413

RTC-188098

 


IJ30255

TS004733640

 

O365 Reconciliation always return the user dump.

 

 

 

Items closed in release (10.0.1)

 

 

Bug 3205

RTC-186971 

 


IJ25857
IJ28627
TS003602420

 

IGI - Office 365 Adapter - error when removing permissions and synchronizing


Bug 3341
RTC - 187888


IJ28185
TS004141914


Office 365 Adapter Connection Issues >> DOC update request

 

 

 

Items closed in release (7.1.17)

 

 

Bug 3192

RTC-186987

 


TS003510180

 

O365 addUser fails with “SourceAnchor is a required property for creation of a federated user.

 

 

 

Items closed in release (7.1.16)

 


Bug 3101
RTC-
185443


IJ21229
TS003018167


Modify User Licenses fail

 

 

 

Items closed in release (7.1.15)

 


Bug 3025
RTC-185101

 

IJ20971


Documentation link to Office 365 Community Blog broken


Bug 3039

RTC-185424


TS002696239


O365 Adapter - Token Expired Error


Bug 3043
RTC-185300


TS002717483


Adapter for Office 365 - how to obtain certificates.
Provided private proxy support for adapter


Bug 3080
RTC-185425


TS002930007


O365 - Recon - Java out of memory error

 

 


Items closed in release (7.1.14)

 


Bug 2816

RTC-184344


TS002203748

 

Office 365 code clean-up and handling exceptions correctly, follow-up for Bugs 2816


Bug 3002
RTC-184668


TS002472132


Group memberships are processed in full or filtered reconciliations. Supporting data reconciliations bring back group data

 

 

 

 

Items closed in release (7.1.13)

 

 

Bug 2866 

RTC-183802

 


TS001989647

 

Office365 unable to provision license

 

Bug 2882

RTC-183801
 


TS002106550

 

Plan id is same as sku id when no. of plan ids is 1

 

 

 

Bug 2885

RTC -183478

 


TS002117817

 

Issues with immutableid attributes

 

 

Bug 2909

RTC-183806
 


TS002193653

 

O365 filtered recons

 

 

Bug 2916

RTC-183805

 

 


TS002238367

 

adapter hangs when deleting an account that does not exist on O365


Bug 2816
RTC-183242


TS001558340

 

 

Office365 recon failure - adapter is unable to recon large data

 

 

 

Items closed in release (7.1.12)

 

 

181613

 

 

 

Facing issue while performing Change Password operation for Office365 adapter on IGI 5.2.5.

 

180753

 

 

TS001074802 / IJ11132

 

 

Modified the GetGroupMembership REST request. Added parameter to fetch defined number of entries from the resource.

 

 

181527

 

 

Internal - As an Office 365 adapter, I must ensure that the dn target attribute should be mapped to dn governance attribute by default

 

 

 

 

Items closed in release (7.1.11)

 

 

 172672

 

TS000109852 / IJ04343

 

The Recon doesn't terminate automatically in IGI 5.2.3.1

 

 

 

 

Items closed in 7.1.10 release

 

 

 

 

None

 

 

 

 

Items closed in 7.1.9 release

 

 

 154064

 

 

The 'directoryRoles' segment is used to manage roles instead of 'roles' and objectId to reference roles. This is due to a change in Microsoft API.

 

 

 154151

 

75579,082,000

 

The license removal needs an explicit call to remove the SKU in case no service plans are enabled. This is due to a change in Microsoft API.

 

 

 

 

Items closed in 7.1.8 release

 

 

 

 

Initial Release compliant with IGI 5.2.2

 

 

 

 

Items closed in 7.0.6 release

 

 

136441

 

 

The list of available license service plans should return licenses that are enabled for provisioning applicable for provisioning at user level.

 

 

136435

 

 

App Key is masked in the Debug log

 

 

 

 

Items closed in 7.0.5 release

 

 

132680

 

 

The App key is hidden in service form. The attribute "ero365appkey" is added in password.attributes list in enRole.properties in <ISIM_HOME>/data directory.

 

 

 

 

 

Items closed in 7.0.4 release

 

 

 

 

 

Initial release.

 

 

 

 

Known limitations

 

Internal#

APAR# / CASE#

Description

 

N/A

 

N/A

 

Attributes that require an SharePoint Online (SPO) license are not supported in the current release of the adapter.

 

 

N/A

 

N/A

 

Attributes and/or operations that are not supported in the production version of Microsoft Graph API are not supported in the adapter.

 

N/A

N/A

Currently, we don't support "Directory (Azure AD) extensions" attributes called also as the custom attributes indicated in this document:
https://learn.microsoft.com/en-us/graph/extensibility-overview?tabs=http

 

N/A

 

 

N/A

 

 

The adapter doesn't support deletion of all mails in otherMails attribute in case of ISVG.

 

 

N/A

 

N/A

 

User Principal Name is ReadWrite Attribute. It is not recommended to update User Principal Name from target as after reconciliation new user will be created and you need to associate user manually again for that user. Always prefer to update User Principal Name from ISIM/IGI to maintain consistency.

 

 

N/A

 

N/A


The adapter supports user level as well as companywide licenses. Adapter supports provisioning for both the licenses, but adapter doesn’t support deprovisioning for companywide license. This is limitation of Microsoft graph API. API doesn’t allow to delete companywide license. If you want to remove companywide service plan, then you must do this on the O365 portal by removing the entire license in which the companywide service plan is included.

 

N/A

 

N/A

 

The adapter does not support duplicated Group Display Name.

 

 

N/A

 

N/A

 

The adapter does not support change of Group Name. This is a limitation of the IBM Security Verify Manager. Attempting to change the Group Name will result in the following error: " CTGIMI046E You cannot change the value of the attribute that is mapped to ergroupname."

 

 

N/A

 

N/A

 

The service principal that represents the adapter service must be in an administrator role that has permissions to modify role objects to send POST or DELETE requests. It must be in a role that has permissions to read role objects to send GET requests. For more information about administrator roles in Windows Azure AD Graph, see Windows Azure AD Graph and Role-Based Access Control. http://msdn.microsoft.com/en-us/library/azure/dn385717.aspx

 

 

N/A

 

N/A

 

Microsoft has a limitation that user accounts cannot be added or modified in a federated domain from an on-premise Dir Sync Active Directory, which is not the default domain. Provisioning of users in such domain can be done by using the AD adapter and then syncing it back to the Azure Directory using the Microsoft DirSync tool.

 

 

N/A

 

N/A

 

The "Enable detailed TDI debugging" on the Service Form has been removed from 7.0.2 release due to security reasons. Instead, "DEBUG" in the ITDI log4j.properties file is to be used to enable extra debug logging.

 

 

SVGAD-4628

 

N/A

 

Exchange Online feature is not supported with containerized installation of adapter.

 

 

Installation and Configuration Notes

  See the IBM Security Verify Governance Adapter Installation and Configuration Guide for detailed instructions.

 

Corrections to Installation guide:

 

Chapter 1: Overview
            Nothing to update

 

Chapter 2: Planning

            Nothing to update 

 

Chapter 3: Installing

            Nothing to update 

 

Chapter 4: Upgrading

             Nothing to update

 

Chapter 5: Configuring

           Nothing to update

 

 

Chapter 6: Troubleshooting

 

Error messages and problem solving

 

   Add below error in Table1

 

Problem

Corrective Action

Reconciliation takes more than 24 hours. Or Reconciliation failed after 24 hours.

Use Users Endpoint Filter Query at service level to filter out users and create more than one services of Adapter to fetch full set of data.

 

 

 

 

Chapter 7: Reference
           Nothing to Update

 

 

   Installation Platform

The IBM Security Verify Governance Adapter for Office 365 was built and tested on the following product versions.

Adapter Installation Platform: 

Due to continuous Java security updates that may be applied to your IBM Security Verify Governance server and IBM Security Verify Governance Identity Manager server, the following SDI releases are the officially supported versions:
           
-  Security Directory Integrator 7.2 + FP14

          -  IBM Verify Directory Integrator 11.0.0

          -  Security Verify Directory Integrator 10.0.0 + FP05

Note:  Earlier versions of SDI that are still supported may function properly, however to resolve any communication errors, you must upgrade your SDI releases to the officially supported versions by the adapters. Please refer to the adapter's installation and configuration guides for the latest update on IBM Security Directory Integrator versions and fix packs

 

Managed Resource: 

Office 365 supported HTTP Client component:

 -        Apache HTTP Component Client

-        Powershell 7.5.0

-        Exchange Online Module v3.0

3rd Party Client Libraries:

        httpclient-4.5.14.jar

Download the httpclient-4.5.14.jar from

https://mvnrepository.com/artifact/org.apache.httpcomponents/httpclient/4.5.14

        httpcore-4.4.16.jar

Download the httpcore-4.4.16.jar from

https://mvnrepository.com/artifact/org.apache.httpcomponents/httpcore/4.4.16

        commons-logging-1.2.jar

Download the commons-logging-1.2.jar from

https://mvnrepository.com/artifact/commons-logging/commons-logging/1.2

Supported IBM Security Verify Governance servers

·      IBM Verify Identity Governance v11.0

·       IBM Security Verify Governance Identity Manager v10.0*

·      IBM Security Verify Governance v10.0

* Unless this document specifies a specific fix pack version of ISVG Identity Manager v10, we expect the adapter to work with ISIM 6 as well. However, it will only be debugged and fixed from the perspective of ISVG-IM v10.

 

Notices

This information was developed for products and services offered in the U.S.A. IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-IBM product, program, or service.

IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not give you any license to these patents. You can send license inquiries, in writing, to:

 

IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY  10504-1785 U.S.A.

 

For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to:

 

Intellectual Property Licensing
Legal and Intellectual Property Law
IBM Japan, Ltd.
1623-14, Shimotsuruma, Yamato-shi
Kanagawa 242-8502 Japan

 

This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice.

Any references in this information to non-IBM Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk.

IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged should contact:

IBM Corporation
2ZA4/101
11400 Burnet Road
Austin, TX 78758 U.S.A.

 

Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee.

The licensed program described in this information and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement, or any equivalent agreement between us.

Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurements may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment.

Information concerning non-IBM products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products.

Trademarks

IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at
www.ibm.com/legal/copytrade.shtml.

Microsoft, Windows, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both.

Java and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates.