Exchange 2007+ Server

If you target a particular Exchange server in the address line, you do not need to install the client software for Exchange.

When installing client software for Exchange, ensure that the server is a member of a domain running in native mode.

Bravura Security Fabric manages Exchange mailboxes using an Active Directory domain administrator account. The administrative account must be a Domain user with membership in the local administrators group on the Exchange server and the Domain Admins group.

Ensure that you set and note the account’s password. You will be required to enter the login ID and password when you add the target system to Bravura Security Fabric .

After the account is created, the services that run the connector (Transaction Monitor Service (idtm) or Proxy Service (psproxy)) need to be updated to run under this Domain account. You must grant sufficient privileges to the Domain user on the Server member before it can run the service.

Provide the target system administrator account the required permissions to user mailboxes. For example; if you want to update profile and request attributes for mailboxes, run the following command from PowerShell to provide the target system administrator Full Access permissions to all mailboxes.

Get-Mailbox -ResultSize unlimited -Filter {RecipientTypeDetails -eq
'UserMailbox'} | Add-MailboxPermission -User John -AccessRights FullAccess
-InheritanceType All

Refer to Microsoft’s documentation for more PowerShell commands.

You can restrict Bravura Security Fabric to list only those mailboxes and groups that exist in one or more named containers; for example, if your Active Directory is divided into organizational units. To do this, on the Target system address configuration page, specify OU in OUs to list users from field. Select List from the drop-down list box and use the More button to add input box for additional OU given. For example:

'OU=people,OU=it,DC=example,DC=com'
'OU=people,OU=hr,DC=example,DC=com'

If there are many OUs to list, there is an option to include all OUs in a file. To use the file, select the File option from the drop-down list and specify the file name.

The file must be located in the <Program Files path>\Bravura Security\Bravura Security Fabric\<instance>\ script\ directory and contain a list of OUs to list from:

   # KVGROUP-V2.0
   listOUs = {
     "OU=people,OU=it,DC=example,DC=com";
     "OU=people,OU=hr,DC=example,DC=com";
   }

The connector will not list any OU if an OU file is empty.

You can restrict Bravura Security Fabric to list only those mailboxes that exist in one or more named databases, if mailboxes in your organization are stored in different mailboxes. To do this, on the Target system address configuration page, specify database in DBs to list users from field , usethe More button to add input box for additional databases given.

If you leave this field empty, the connector will list users from all databases.

The _out_of_office attribute is used by the first chance escalation plugin. This attribute is leveraged to auto-escalate to a different authorizer for approval if the current authorizer is flagged as out-of-office. Retrieval of out-of-office status is only supported on Exchange 2010+ systems.

The following pseudo attributes are supported to allow you to create or delete Active Directory distribution groups and mail enable them.

The following pseudo attribute is supported to allow the owner of a mailbox to delegate permissions for access for their mailbox to another user:

These options must be set in the same form and fashion as you would set them using Add-MailboxPermission from the Exchange Management PowerShell console.

The following pseudo attributes are supported across Exchange to configure message size limits for mailboxes:

These options must be set in the same form and fashion as you would set them using Set-Mailbox from the Exchange Management PowerShell console.

You can configure Bravura Security Fabric to use a profile/request attribute to prompt users for the destination mailbox database when creating or moving accounts on a target system that supports contexts.

When the Profile/request attribute to use as the container DN option is configured on the Target system information page (Manage the system >Resources >Target systems) , users can:

To allow users to select a mailbox database for a create account or move context operation:

You can configure the Bravura Security Fabric to allow users to archive their mailboxes, using the following attributes:

This operation is supported only for existing mailboxes, and is not supported when creating a new mailbox.