O365, Mailboxes and Disabled Accounts

[Firefox]

Hello,

 

Wondering if anyone else has a different way of getting round the disabled accounts and mailbox issue in O365?

 

Scenario:

Create Account in AD with Mailbox

Dirsync runs to sync the user to O365

Migrate Mailbox to the cloud

User leaves, account is disabled, mailbox automatically deletes

 

What if once a user has left you want this mailbox to be available to other users for a period of time? I see an article about converting the mailbox to a shared mailbox first, but disabling the account still deletes this.

 

This seems to leave me with the options of

A) leaving users that have left the organisation enabled in AD (Not great for security)

B) (Guessing as have not tried) Altering the filtering of the Dirsync AD MA to also sync disabled accounts

C) Dumping all the mail of of the mailbox to another location (Not ideal)

 

This also presents the issue for shared mailboxes, previously on a prem, we could disable the AD account for a shared mailbox, and it could be accessed without issue. We are now having to enable all out shared mailbox accounts (Again not great from a security point of view)

[snagrat]

Mailbox should not be deleted if you disable the user. Should just stop sign in.

 

If you delete user then mailbox will be deleted.

 

I would convert mailbox to Shared and change AD password. Then they can still access mailbox but cannot login to computers

[FN-GM]

User leaves, account is disabled, mailbox automatically deletes

 

When someone is disabled the mailbox isn't deleted. The account is disabled like it is in AD. Its only deleted when it is deleted in AD.

[Firefox]

Mailbox should not be deleted if you disable the user. Should just stop sign in.

 

If you delete user then mailbox will be deleted.

 

I would convert mailbox to Shared and change AD password. Then they can still access mailbox but cannot login to computers

 

That's what we're looking at having to do, but I hate leaving inactive accounts still enabled

 

 

 

When someone is disabled the mailbox isn't deleted. The account is disabled like it is in AD. Its only deleted when it is deleted in AD.

 

This is how we'd like it to work. But If I disable the account in AD, after the next Dirsync, the account disappears from shared mailboxes, and when I look under deleted mailboxes, there it is :-/

Edited June 9, 2016 by Firefox

[snagrat]

This is how we'd like it to work. But If I disable the account in AD, after the next Dirsync, the account disappears from shared mailboxes, and when I look under deleted mailboxes, there it is :-/

 

Your not moving the users to a new OU are you?

[Firefox]

Your not moving the users to a new OU are you?

 

No, they remain exactly where they were