IA-Connect JML

The name of the Active Directory group. This appears in the 'Name' column in AD users and computers and in the top of the Group 'General' tab (in the title).

The group name (pre-Windows 2000) in Active Directory. This is in the format 'name' (e.g. 'TestGroup1').

The Organizational Unit (OU) in which to store the group in Distinguished Name format (e.g. OU=Target OU,OU=London,DC=mydomain,DC=local), GUID format or as a path (e.g. MyGroups\London). If this is left blank, the group will be created in the 'Users' OU.

The optional group description.

The optional group notes.

The optional group display name. Unlike user accounts, a group display name doesn't show in AD users and computers.

The type of group to create. A security group is typically used to manage user and computer access to IT resources. A distribution group is typically used to create a group email, allowing you to email a group of users.

The scope of the group to create. There are a complex set of rules describing where a group can be referenced and what can be placed in a group, depending on that group's scope. You cannot always convert to another group scope later, so you should pick the correct scope at creation.

The optional group home page.

Specifies the user or group that manages this group. You can specify this input in Distinguished Name format (e.g. CN=MrBig,OU=London,DC=mydomain,DC=local), GUID format, SID or SAMAccountName (e.g. 'MrBig').

Set to true to protect this group from accidental deletion. Set to false to leave the group at the default of not being protected from accidental deletion.

The optional name or Fully Qualified Domain Name (FQDN) of an Active Directory Domain Controller (DC) to contact to perform the requested action. If left blank, the Active Directory Domain Controller (DC) is automatically determined using site settings.

Add the following expression here: workflow()

The identity of the Active Directory group. You can specify a group by Distinguished Name (e.g. CN=Group1,OU=My Groups,DC=mydomain,DC=local), GUID, SID, or SAMAccountName / pre-2K name (e.g. 'Group1'). You cannot use display name or group name (although group name will often be the same as pre-2K name which can be used).

As an alternative to searching by identity, provide the pre-2K name (SAMAccountName) of the Active Directory group. Since the 'Group identity' input also accepts the pre-2K name, this input is now redundant, but maintained for backwards compatibility.

The group member to add (typically a user, group or computer). You can specify a user or group by Distinguished Name (e.g. CN=User1,OU=My Groups,DC=mydomain,DC=local), GUID, SID, or SAMAccountName / pre-2K name (e.g. 'User1'). You can specify a computer by Distinguished Name or computer name (pre-2K) followed by a $ (e.g. VM01$).

The optional name or Fully Qualified Domain Name (FQDN) of an Active Directory Domain Controller (DC) to contact to perform the requested action. If left blank, the Active Directory Domain Controller (DC) is automatically determined using site settings.

Add the following expression here: workflow()

The object (typically a user, group or computer) to add to the one or more groups. You can specify a user or group by Distinguished Name (e.g. CN=User1,OU=My Groups,DC=mydomain,DC=local), GUID, SID, or SAMAccountName / pre-2K name (e.g. 'User1'). You can specify a computer by Distinguished Name or computer name (pre-2K) followed by a $ (e.g. VM01$).

A list of the AD groups to add the object to, in JSON or CSV format. For example: [{"GroupName": "Group 1"}, {"GroupName": "Group 2"}] (JSON table format), ["Group 1", "Group 2"] (JSON array format), or Group 1,Group 2 (CSV format). You can specify a group by Distinguished Name (e.g. CN=Group1,OU=My Groups,DC=mydomain,DC=local), GUID, SID, or SAMAccountName / pre-2K name (e.g. 'Group1'). You cannot use display name or group name (although group name will often be the same as pre-2K name which can be used).

If set to true: An exception (failure) will be raised if any single group fails to add (i.e. 100% success is a requirement). If no exception is raised, this action will report how many groups were added successfully and how many failed to add.

If set to true: An exception (failure) will be raised only if all groups fail to add (i.e. no successes and some failures). If no exception is raised, this action will report how many groups were added successfully and how many failed to add.

The optional name or Fully Qualified Domain Name (FQDN) of an Active Directory Domain Controller (DC) to contact to perform the requested action. If left blank, the Active Directory Domain Controller (DC) is automatically determined using site settings.

If a large number of AD groups is specified for addition, this might cause a timeout. By setting the 'Max groups per call' value to 1 or higher, the IA-Connect Orchestrator will split this action into multiple calls to the IA-Connect Director and Agent with the specified maximum number of groups per call. First available in IA-Connect 9.3. For example: If you set a value of 5 and 14 groups are requested for addition, the Orchestrator will split this into requests of 5, 5, 4.

Add the following expression here: workflow()

The name of the Active Directory OU. This appears in the OU tree structure in AD users and computers and in the top of the OU properties 'General' tab (in the title).

The Organizational Unit (OU) in which to store the new OU in Distinguished Name format (e.g. OU=Parent OU,OU=London,DC=mydomain,DC=local), GUID format or as a path (e.g. London\Parent OU). If this is left blank, the OU will be created in the root of the tree.

The optional OU description.

The optional OU display name. Unlike user accounts, a OU display name doesn't show in AD users and computers.

Specifies the user or group that manages this OU. You can specify this input in Distinguished Name format (e.g. CN=MrBig,OU=London,DC=mydomain,DC=local), GUID format, SID or SAMAccountName (e.g. 'MrBig').

Set to true (default) to protect this OU from accidental deletion. Set to false to leave the OU unprotected from accidental deletion.

The OU's 'Street' property (in the OU properties 'General' tab in AD users and computers).

The OU's 'City' property (in the OU properties 'General' tab in AD users and computers).

The OU's 'State/province' property (in the OU properties 'General' tab in AD users and computers).

The OU's 'ZIP/Postal Code' property (in the OU properties 'General' tab in AD users and computers).

The optional name or Fully Qualified Domain Name (FQDN) of an Active Directory Domain Controller (DC) to contact to perform the requested action. If left blank, the Active Directory Domain Controller (DC) is automatically determined using site settings.

Add the following expression here: workflow()

The name of the Active Directory user. This appears in the 'Name' column in AD users and computers and in the top of the User 'General' tab (in the title). This is not the user logon name.

The user logon name in Active Directory. This generally should be in the format 'name@domainFQDN' (e.g. '[email protected]'). The user can logon using this format: name@domainFQDN.

The user logon name (pre-Windows 2000) in Active Directory. This is in the format 'name' (e.g. 'TestUser1'). The user can logon using this format: DOMAIN\name.

The optional user first name.

The optional user last name.

The Organizational Unit (OU) in which to store the user in Distinguished Name format (e.g. OU=Target OU,OU=London,DC=mydomain,DC=local), GUID format or as a path (e.g. MyUsers\London). If this is left blank, the user will be created in the 'Users' OU.

The optional user description.

The optional user display name.

The user password. This must be specified and meet the Active Directory password complexity rules. If this is a 'Stored' password, enter in the format {IAConnectPassword:StoredPasswordIdentifier} and set the 'stored password' input to true. If this is an Orchestrator generic credential, enter in the format {OrchestratorCredential:FriendlyName} and set the 'stored password' input to true.

Set to true if the password is an IA-Connect stored password identifier (for example: generated by the 'Generate password' action) or an IA-Connect Orchestrator generic credential (for example: If using IA-Connect with a PA flow).

Set to true if you want the account enabled immediately after creation. Set to false for the account to start disabled. This option defaults to true.

Set to true if you want to force the user to change their password when they login (i.e. the new password being set here is a one-time password to get the user logged-in). Set to false if this is the password the user will use until they manually change it. You cannot set this option to true at the same time as setting either 'User cannot change password' or 'Password never expires' to true.

Set to true to stop the user from being able to change their password. Set to false if the user can change the password. You cannot set this option to true at the same time as setting 'User must change password at next login' to true.

Set to true if the password never expires (i.e. the user will never be prompted to change the password). Set to false if the password can expire as set in Active Directory Domain policy. You cannot set this option to true at the same time as setting 'User must change password at next login' to true.

The optional name or Fully Qualified Domain Name (FQDN) of an Active Directory Domain Controller (DC) to contact to perform the requested action. If left blank, the Active Directory Domain Controller (DC) is automatically determined using site settings.

Add the following expression here: workflow()

The user logon name in Azure Active Directory. This generally should be in the format 'name@domainFQDN' (e.g. '[email protected]').

Set to true if you want the account enabled immediately after creation. Set to false for the account to start disabled. This option defaults to true.

The user password. This must be specified and meet the Azure Active Directory password complexity rules. If this is a 'Stored' password, enter in the format {IAConnectPassword:StoredPasswordIdentifier} and set the 'stored password' input to true. If this is an Orchestrator generic credential, enter in the format {OrchestratorCredential:FriendlyName} and set the 'stored password' input to true.

Set to true if the password is an IA-Connect stored password identifier (for example: generated by the 'Generate password' action) or an IA-Connect Orchestrator generic credential (for example: If using IA-Connect with a PA flow).

The user's first name.

The user's family name / last name / surname.

The full display name for this user.

The name of the City the user lives in, or where their office is located.

The name of the company the user works for.

The Country or Region the user lives in, or where their office is located.

The name of the department the user works for within the Company.

The user's fax (facsimile) telephone number.

The user's job title.

The user's mail nickname.

The user's mobile phone number.

The location of the office where the user works.

The user's telephone number.

The ZIP or postal code where the user lives, or the office they work in.

The user's preferred language. This is typically entered as a two letter language code (ISO 639-1), followed by a dash, followed by a two letter upper-case country code (ISO 3166). For example: en-US, en-GB, fr-FR, ja-JP.

The state, province or county the user lives in, or where their office located.

The street address where the user lives, or their office street address.

A two letter country code (ISO 3166). Required for users that will be assigned licenses due to a legal requirement. For example: US (United States), JP (Japan), GB (United Kingdom), FR (France), IN (India). See https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes.

The age group of the user, for parental control purposes. The default is none / not specified which (from a controls perspective) is the same as Adult.

If the 'Age group' is 'Minor', this field allows you to specify whether consent has been provided for the minor, for parental control purposes.

An optional employee Id. You might use this to uniquely distinguish between each user in your organisation.

Set to true if you want to force the user to change their password when they next login (i.e. the new password being set here is a one-time password to allow the user to log in). Set to false if this is the password the user will use until they manually change it.

Set to true to enforce the Azure Active Directory change password policy which (depending on your environment) can define how often the user should change their password, password recovery options and additional security verification. This may cause the user to be prompted for additional information.

Set to true if the password never expires (i.e. the user will never be prompted to change the password). Set to false if the password can expire as set in the Azure Active Directory password policy.

Add the following expression here: workflow()

The Id of an Azure Active Directory user. You can specify a user by UPN (e.g. [email protected]) or ObjectId (e.g. UUID/GUID value).

The Id or display name of an Azure Active Directory group. You can specify a group by Display Name (e.g. "Finance users") or ObjectId (e.g. UUID/GUID value).

If set to true, IA-Connect will check the user's group memberships before attempting to add them to the group. If the user is already a member of the group, IA-Connect will simply report success without having to do anything. If set to false, IA-Connect will immediately add the user to the group without checking, resulting in an error if the user is already in the group.

Add the following expression here: workflow()

The Id of an Azure Active Directory user. You can specify a user by UPN (e.g. [email protected]) or ObjectId (e.g. UUID/GUID value).

A list of the Ids or display names of Azure AD groups to add the user to, in JSON or CSV format. For example: [{"GroupName": "Group 1"}, {"GroupName": "Group 2"}] (JSON table format), ["Group 1", "Group 2"] (JSON array format), or Group 1,Group 2 (CSV format).

If set to true: An exception (failure) will be raised if any single group fails to add (i.e. 100% success is a requirement). Some groups (for example: Office 365 groups) might not add so an exception could be common. If no exception is raised, this action will report how many groups were added successfully and how many failed to add.

If set to true: An exception (failure) will be raised only if all groups fail to add (i.e. no successes and some failures). If no exception is raised, this action will report how many groups were added successfully and how many failed to add.

If set to true, IA-Connect will check the user's group memberships before attempting to add them to the group. If the user is already a member of the group, IA-Connect will simply report success without having to do anything. If set to false, IA-Connect will immediately add the user to the group without checking, resulting in an error if the user is already in the group.

If a large number of Azure AD groups is specified for addition, this might cause a timeout. By setting the 'Max Azure AD groups per call' value to 1 or higher, the IA-Connect Orchestrator will split this action into multiple calls to the IA-Connect Director and Agent with the specified maximum number of groups per call. For example: If you set a value of 5 and 14 groups need to be removed, the Orchestrator will split this into requests of 5, 5, 4.

Add the following expression here: workflow()

The identity of the Microsoft Exchange mailbox. You can specify a mailbox by Name, Alias, Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), DOMAIN\username, Email address, GUID, SAMAccountName or User Principal Name (UPN).

The active Directory object (e.g. user or group) to assign the permissions to. You can specify a user by Name, Alias, Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), DOMAIN\username, Email address, GUID, SAMAccountName or User Principal Name (UPN).

The access rights to assign to the user's permissions on the mailbox. Available options are 'AccessSystemSecurity', 'CreateChild', 'DeleteChild', 'ListChildren', 'Self', 'ReadProperty', 'WriteProperty', 'DeleteTree', 'ListObject', 'ExtendedRight', 'Delete', 'ReadControl', 'GenericExecute', 'GenericWrite', 'GenericRead', 'WriteDacl', 'WriteOwner', 'GenericAll' and 'Synchronize'.

An optional extended right to assign to the user's permissions on the mailbox. Extended rights include 'Send As'.

Add the following expression here: workflow()

The identity of the Microsoft Exchange mailbox. You can specify a mailbox by Name, Alias, Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), DOMAIN\username, Email address, GUID, SAMAccountName or User Principal Name (UPN).

The user to add to the mailbox permissions. You can specify a user by Name, Alias, Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), DOMAIN\username, Email address, GUID, SAMAccountName or User Principal Name (UPN).

The access rights to assign to the user's permissions on the mailbox. Available options are 'ChangeOwner', 'ChangePermission', 'DeleteItem', 'ExternalAccount', 'FullAccess' and 'ReadPermission'.

If set to true, the mailbox and user account will have some additional properties set that will result in Outlook automatically opening the mailbox when logged-in as this user. This can take a few minutes to take effect. If set to false, the additional properties will not be set and Outlook will not automatically open the mailbox.

Add the following expression here: workflow()

The identity of the distribution group to add to. You can specify a distribution group by Name, Alias, Distinguished Name (e.g. CN=MyGroup,OU=My Groups,DC=mydomain,DC=local), Email address or GUID.

The identity of the member to add to the distribution group. You can specify a mailbox by Name, Alias, Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), DOMAIN\username, Email address, GUID, SAMAccountName or User Principal Name (UPN).

Add the following expression here: workflow()

The identity of the Active Directory group. You can specify a group by Distinguished Name (e.g. CN=Group1,OU=My Groups,DC=mydomain,DC=local), GUID, SID, or SAMAccountName / pre-2K name (e.g. 'Group1'). You cannot use display name or group name (although group name will often be the same as pre-2K name which can be used).

A list of the members (typically users, groups or computers) to add to the AD group, in JSON or CSV format. For example: [{"MemberName": "User 1"}, {"MemberName": "User 2"}] (JSON table format), ["User 1", "User 2"] (JSON array format), or User 1,User 2 (CSV format). You can specify a user or group by Distinguished Name (e.g. CN=User1,OU=My Groups,DC=mydomain,DC=local), GUID, SID, or SAMAccountName / pre-2K name (e.g. 'User1'). You can specify a computer by Distinguished Name or computer name (pre-2K) followed by a $ (e.g. VM01$).

If set to true: An exception (failure) will be raised if any single members fails to add (i.e. 100% success is a requirement). If no exception is raised, this action will report how many members were added successfully and how many failed to add.

If set to true: An exception (failure) will be raised only if all members fail to add (i.e. no successes and some failures). If no exception is raised, this action will report how many members were added successfully and how many failed to add.

If set to true, all members will be added to the group in a single action. This will be faster, but if a single member doesn't exist or fails to add, no members will be added and an exception will be raised, regardless of the 'Exception' input options. If set to false (the default), each member will be added individually and the IA-Connect Agent will count how many added successfully and how many failed to add. If adding members to groups across domains, it is recommended to set this input to false.

The optional name or Fully Qualified Domain Name (FQDN) of an Active Directory Domain Controller (DC) to contact to perform the requested action. If left blank, the Active Directory Domain Controller (DC) is automatically determined using site settings.

Add the following expression here: workflow()

The Id of a Microsoft Exchange Online or Office 365 mailbox. You can specify a mailbox by Name, Alias, Object Id (e.g. UUID/GUID value), Email address, GUID, SAMAccountName (even users in non Active Directory connected environments have a SAMAccountName) or User Principal Name (UPN).

The mailbox user, user or mail-enabled security group to receive the mailbox permissions. You can specify a mailbox by Name, Alias, Object Id (e.g. UUID/GUID value), Email address, GUID, SAMAccountName (even users in non Active Directory connected environments have a SAMAccountName) or User Principal Name (UPN).

The access rights to assign to the user's permissions on the mailbox. Available options are 'ChangeOwner', 'ChangePermission', 'DeleteItem', 'ExternalAccount', 'FullAccess' and 'ReadPermission'.

If set to true, the mailbox and user account will have some additional properties set that will result in Outlook automatically opening the mailbox when logged-in as this user. This can take a few minutes to take effect. If set to false, the additional properties will not be set and Outlook will not automatically open the mailbox.

Add the following expression here: workflow()

The identity of the distribution group or mail-enabled security group to add to. You can specify a distribution group by Name, Alias, Distinguished Name (e.g. CN=MyGroup,OU=My Groups,DC=mydomain,DC=local), Email address or GUID.

The identity of the member to add to the distribution group or mail-enabled security group. You can specify a mailbox by Name, Alias, Object Id (e.g. UUID/GUID value), Email address, GUID, SAMAccountName (even users in non Active Directory connected environments have a SAMAccountName) or User Principal Name (UPN).

Add the following expression here: workflow()

The Id of an Azure Active Directory user. You can specify a user by UPN (e.g. [email protected]) or ObjectId (e.g. UUID/GUID value).

The Id or display name of an Azure Active Directory admin role. You can specify an AAD admin role by Display Name (e.g. "Application Developer") or ObjectId (e.g. UUID/GUID value).

The directory scope Id for the role assignment. For example: / represents the entire tenant, /GUID represents an app registration, /administrativeUnits/GUID represents an administrative unit.

If set to true (the default), IA-Connect will check the user's role assignments before attempting to assign them to the role. If the user is already assigned to the role, IA-Connect will simply report success without having to do anything. If set to false, IA-Connect will immediately assign the user to the role without checking, resulting in an error if the user is already assigned to the role.

Add the following expression here: workflow()

The Id of an Azure Active Directory user. You can specify a user by UPN (e.g. [email protected]) or ObjectId (e.g. UUID/GUID value).

A list of the admin roles to assign to the user, in JSON or CSV format. For example: [{"Role": "Application Developer"}, {"Role": "Exchange Administrator"}] (JSON table format), ["Application Developer", "Exchange Administrator"] (JSON array format) or Application Developer,Exchange Administrator (CSV format). You can specify an AAD admin role by Display Name (e.g. "Application Developer") or ObjectId (e.g. UUID/GUID value).

If set to true: An exception (failure) will be raised if any single Azure AD admin role fails to assign (i.e. 100% success is a requirement). If no exception is raised, this action will report how many Azure AD admin roles were assigned successfully and how many failed to assign.

If set to true: An exception (failure) will be raised only if all Azure AD admin roles fail to assign (i.e. no successes and some failures). If no exception is raised, this action will report how many Azure AD admin roles were assigned successfully and how many failed to assign.

The directory scope Id for all roles being assigned. For example: / represents the entire tenant, /GUID represents an app registration, /administrativeUnits/GUID represents an administrative unit.

If set to true (the default), IA-Connect will check the user's role assignments before attempting to assign them to the role. If the user is already assigned to the role, IA-Connect will simply report success without having to do anything. If set to false, IA-Connect will immediately assign the user to the role without checking, resulting in an error if the user is already assigned to the role.

If set to true (the default) and one or more of the roles are provided in Object Id format, IA-Connect will double-check those role Ids are valid. This is recommended because the error message received from Azure AD, when you provide an invalid Object Id, isn't helpful. If set to false, IA-Connect will not double-check the validity of any provided role Ids, which is faster.

Add the following expression here: workflow()

The path to the target Organizational Unit (OU) in Distinguished Name format (e.g. OU=Target OU,OU=London,DC=mydomain,DC=local), GUID format or as a path (e.g. London\Target OU).

The optional name or Fully Qualified Domain Name (FQDN) of an Active Directory Domain Controller (DC) to contact to perform the requested action. If left blank, the Active Directory Domain Controller (DC) is automatically determined using site settings.

Add the following expression here: workflow()

The identity of the Active Directory user. You can specify a user by Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), GUID, SID, SAMAccountName / pre-2K name (e.g. 'User1') or Name (e.g. 'User1').

The optional name or Fully Qualified Domain Name (FQDN) of an Active Directory Domain Controller (DC) to contact to perform the requested action. If left blank, the Active Directory Domain Controller (DC) is automatically determined using site settings.

Add the following expression here: workflow()

The identity of the source Active Directory user (the user to copy groups from). You can specify a user by Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), GUID, SID, SAMAccountName / pre-2K name (e.g. 'User1') or Name (e.g. 'User1').

The identity of the destination Active Directory user (the user to add the groups to). You can specify a user by Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), GUID, SID, SAMAccountName / pre-2K name (e.g. 'User1') or Name (e.g. 'User1').

The optional name or Fully Qualified Domain Name (FQDN) of an Active Directory Domain Controller (DC) to contact to perform the requested action. If left blank, the Active Directory Domain Controller (DC) is automatically determined using site settings.

Add the following expression here: workflow()

The identity of the source Active Directory user (the user to copy attributes from). You can specify a user by Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), GUID, SID, SAMAccountName / pre-2K name (e.g. 'User1') or Name (e.g. 'User1').

The identity of the destination Active Directory user (the user to copy attributes to). You can specify a user by Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), GUID, SID, SAMAccountName / pre-2K name (e.g. 'User1') or Name (e.g. 'User1').

A comma separated list of user properties to copy from the source user to the destination user. Common properties to clone include: city, company, country, department, description, division, enabled, homedirectory, homedrive, homephone, manager, office, organization, postalcode, profilepath, scriptpath, state, streetaddress.

The optional name or Fully Qualified Domain Name (FQDN) of an Active Directory Domain Controller (DC) to contact to perform the requested action. If left blank, the Active Directory Domain Controller (DC) is automatically determined using site settings.

Add the following expression here: workflow()

The username of the account to use when running Active Directory commands. You can specify a username in the format 'DOMAIN\username' (e.g. TESTDOMAIN\admin) or 'username@domainFQDN' (e.g. [email protected]).

The password of the account to use when running Active Directory commands.

The name or Fully Qualified Domain Name (FQDN) of an Active Directory Domain Controller (DC) or member server to authenticate against and for all Active Directory actions to be passed to. If left blank, the Active Directory Domain Controller (DC) is automatically determined using site settings. If a member server is entered (instead of a Domain Controller), that member server must have the Active Directory PowerShell modules / RSAT installed.

Set to true to connect to the remote WSMan endpoint using SSL.

Set to an alternative TCP port if not using the default WSMan TCP/5985 (non-SSL) or TCP/5986 (SSL).

Add the following expression here: workflow()

The application Id of the Azure AD app registration which contains the certificate and has the required roles in Azure AD to perform the automation actions. This Azure AD app registration must have previously been setup by an administrator.

The thumbprint of the certificate used for authentication. This certificate must have been previously created and exist both on the computer where IA-Connect is performing the automation actions and in the Azure AD app registration.

Azure Tenant Id to connect to. This must be specified when using certificates to authenticate.

The API to use for connection to Azure AD. Once set, all further Azure AD commands issued by IA-Connect will use this API. If set to auto (the default), the installed PowerShell modules will be scanned and selected in the following order: Microsoft Graph Users PowerShell module, Azure AD v2 PowerShell module. The Azure AD v2 PowerShell module is deprecated on March 30th 2024 and hence it is recommended to use the Microsoft Graph Users PowerShell module.

Add the following expression here: workflow()

The username of the account to use when running Azure AD v2 PowerShell commands.

The password of the account to use when running Azure AD v2 PowerShell commands.

The optional Azure Tenant Id to connect to. If this is left blank, the default Tenant associated with the supplied user account is used.

The API to use for connection to Azure AD. Once set, all further Azure AD commands issued by IA-Connect will use this API. If set to auto (the default), the installed PowerShell modules will be scanned and selected in the following order: Microsoft Graph Users PowerShell module, Azure AD v2 PowerShell module. The Azure AD v2 PowerShell module is deprecated on March 30th 2024 and hence it is recommended to use the Microsoft Graph Users PowerShell module.

The scope of permissions required, to perform all automation tasks in this Azure AD login session. By default, IA-Connect will request a permission scope to allow modification of users, groups and license assignments. This setting is only used when connecting using the Microsoft Graph Users PowerShell module.

Add the following expression here: workflow()

Add the following expression here: workflow()

Friendly name of the JML environment held in the IA-Connect Orchestrator.

Only applies to Exchange and Office 365 Exchange Online. If set to false: This action will always connect to Exchange or Office 365 Exchange Online even if IA-Connect is already connected. If set to true (the default): If IA-Connect is already connected to Exchange or Office 365 Exchange Online with identical settings and the Exchange connection is responding, IA-Connect will do nothing since the connection is already established.

Add the following expression here: workflow()

The username of the account to use when running Exchange PowerShell commands. You can specify a username in the format 'DOMAIN\username' (e.g. TESTDOMAIN\admin) or 'username@domainFQDN' (e.g. [email protected]). If you don't specify a username and password, all subsequent Exchange actions will run as the user account the IA-Connect Agent is running as.

The password of the account to use when running Exchange PowerShell commands.

The Fully Qualified Domain Name (FQDN) or hostname of the Microsoft Exchange server.

Set to true if you wish to connect to the Microsoft Exchange server using HTTPS / SSL. This will encrypt all traffic but only works if the Exchange server is setup to accept PowerShell commands over SSL.

Which method should be used to connect to Microsoft Exchange. 'Local' imports the remote Exchange runspace locally and runs commands locally. 'Remote' runs directly in the remote Exchange runspace and may not be able to run generic PowerShell scripts due to security restrictions.

The authentication mechanism to be used if connecting to a remote computer or running the script as an alternative user. Supported values are 'Basic', 'Credssp', 'Default', 'Digest', 'Kerberos' and 'Negotiate'.

If set to false: This action will always connect to Exchange even if IA-Connect is already connected. If set to true (the default): If IA-Connect is already connected to Exchange with identical settings and the Exchange connection is responding, IA-Connect will do nothing since the connection is already established.

The 'Local' connection method imports Exchange PowerShell commands locally. This option allows you to choose which PowerShell commands should be imported. Keeping this list to a minimum reduces both memory usage and the time to connect. 'All' (the default, for backwards compatibility) imports all PS commands. 'IA-Connect only' (the recommended option) imports only PS commands used by IA-Connect (you can specify additional PS commands). 'Specified' only imports PS commands you specify and could break some IA-Connect actions if they depend on PS commands you have not specified.

If using the 'Local' connection method and if you have chosen to import either 'IA-Connect only' or 'Specified' PS commands, you can specify a comma separated list of additional PS commands to import. For example: 'Get-Mailbox,New-Mailbox,New-DistributionGroup'.

Add the following expression here: workflow()

The application Id of the Azure AD app registration which contains the certificate and has the required roles in Azure AD to perform the automation actions. This Azure AD app registration must have previously been setup by an administrator.

The thumbprint of the certificate used for authentication. This certificate must have been previously created and exist both on the computer where IA-Connect is performing the automation actions and in the Azure AD app registration.

The Organisation to use for authentication. For example: mytestenvironment.onmicrosoft.com.

The optional URL of the Microsoft Exchange online server to connect to. Only use this if you have a custom URL.

Which method should be used to connect to Microsoft Exchange. 'EXO V1' is the original Microsoft Exchange Online PowerShell and doesn't support certificates (and hence isn't available as an option). 'EXO V2' uses the newer Microsoft Exchange Online PowerShell v2 module which runs on the computer running the IA-Connect Agent and requires the 'ExchangeOnlineManagement' v2 PowerShell module installed.

If set to false: This action will always connect to Office 365 Exchange Online even if IA-Connect is already connected. If set to true (the default): If IA-Connect is already connected to Office 365 Exchange Online with identical settings and the Office 365 Exchange Online connection is responding, IA-Connect will do nothing since the connection is already established.

The 'EXO V2' connection method (required for certificate authentication) imports Office 365 or Exchange Online PowerShell commands locally. This option allows you to choose which PowerShell commands should be imported. Keeping this list to a minimum reduces both memory usage and the time to connect. 'All' (the default, for backwards compatibility) imports all PS commands. 'IA-Connect only' (the recommended option) imports only PS commands used by IA-Connect (you can specify additional PS commands). 'Specified' only imports PS commands you specify and could break some IA-Connect actions if they depend on PS commands you have not specified.

If you have chosen to import either 'IA-Connect only' or 'Specified' PS commands, you can specify a comma separated list of additional PS commands to import. For example: 'Get-Mailbox,New-Mailbox,New-DistributionGroup'.

Add the following expression here: workflow()

The username of the account to use when running Office 365 PowerShell commands.

The password of the account to use when running Office 365 PowerShell commands.

The optional URL of the Microsoft Exchange online server to connect to. Only use this if you have a custom URL.

Which method should be used to connect to Microsoft Exchange. Both 'EXO V1 local' and 'EXO V1 remote' use the original Microsoft Exchange Online PowerShell which runs on the computer running the IA-Connect Agent and does not require any additional PowerShell modules, but will eventually be deprecated. 'EXO V1 local' imports the remote Exchange runspace locally and runs commands locally. 'EXO V1 remote' runs directly in the remote Exchange runspace and cannot run generic PowerShell scripts due to security restrictions. 'EXO V2' uses the newer Microsoft Exchange Online PowerShell v2 module which runs on the computer running the IA-Connect Agent and requires the 'ExchangeOnlineManagement' v2 PowerShell module installed.

If set to false: This action will always connect to Office 365 Exchange Online even if IA-Connect is already connected. If set to true (the default): If IA-Connect is already connected to Office 365 Exchange Online with identical settings and the Office 365 Exchange Online connection is responding, IA-Connect will do nothing since the connection is already established.

The 'EXO v1 local' and 'EXO V2' connection methods import Office 365 or Exchange Online PowerShell commands locally. This option allows you to choose which PowerShell commands should be imported. Keeping this list to a minimum reduces both memory usage and the time to connect. 'All' (the default, for backwards compatibility) imports all PS commands. 'IA-Connect only' (the recommended option) imports only PS commands used by IA-Connect (you can specify additional PS commands). 'Specified' only imports PS commands you specify and could break some IA-Connect actions if they depend on PS commands you have not specified.

If using the 'EXO v1 local' or 'EXO V2' connection methods and if you have chosen to import either 'IA-Connect only' or 'Specified' PS commands, you can specify a comma separated list of additional PS commands to import. For example: 'Get-Mailbox,New-Mailbox,New-DistributionGroup'.

Add the following expression here: workflow()

The identity of the existing user you want to create a mailbox for. You can specify a user by Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), GUID, SID, SAMAccountName / pre-2K name (e.g. 'User1') or Name (e.g. 'User1').

The Exchange alias (also known as mail nickname) for the user. If the email address policy is enabled, this will be used to generate the name component of the Primary SMTP email address (e.g. [email protected]). If the email address policy is not enabled, you may wish to set the primary SMTP address instead.

The display name of the mailbox. This is visible in address lists.

If you are creating a linked mailbox, this allows you to specify the domain controller in the forest where the user account resides. Use the Fully Qualified Domain Name (FQDN) of the domain controller.

If you are creating a linked mailbox, this allows you to specify the account that the mailbox is linked to. You can specify the account by Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), GUID or Name (e.g. 'User1').

The Exchange database to contain the new database. You can specify the database by Distinguished Name, GUID or Name.

The primary return email address that is used for the recipient. You are unlikely to be able to set this if the 'Email address policy' is enabled so either use 'Alias' instead (and the policy will create the Primary SMTP address from the alias) or disable the email address policy.

Set to true if you want to automatically update email addresses based on the email address policy applied to this recipient. If the email address policy is enabled, this generally will impact your ability to set the primary SMTP address. Set to false to disable the feature, giving you full control to manually setting email addresses. Leave blank if you don't want to set this option (i.e. leave at the existing or default value).

Add the following expression here: workflow()

The display name of the group.

The group description.

The email nickname, used to form the group email address.

If set to public (the default), anyone can view the contents of the group and anyone can join the group. If set to private, only members can view the contents of the group and only owners can add new members to the group or approve join requests.

If set to true, IA-Connect will check if the group exists and, if it does exist, IA-Connect will simply report success for that group without having to do anything. If set to false, IA-Connect will create the group without checking, which could result in a duplicate group name.

Add the following expression here: workflow()

The display name of the group.

The group description.

If set to true, IA-Connect will check if the group exists and, if it does exist, IA-Connect will simply report success for that group without having to do anything. If set to false, IA-Connect will create the group without checking, which could result in a duplicate group name.

Add the following expression here: workflow()

The unique name for the new group.

The alias (also known as mail nickname) for the new group. If you don't specify a SMTP address, the alias will be used to generate the name component of the email address (e.g. [email protected]).

The display name of the group. This is visible in address lists.

Optional notes about the object.

The owner of the group. If you don't specify an owner, the user that created the group will become the owner. The owner can be a mailbox, mail user or mail-enabled security group. You can specify a mailbox by Name, Alias, Object Id (e.g. UUID/GUID value), Email address, GUID, SAMAccountName or User Principal Name (UPN).

A comma separated list of members to add to the new group. You can specify members by Name, Alias, Distinguished Name (e.g. CN=MyGroup,OU=My Groups,DC=mydomain,DC=local), Email address or GUID.

The Organizational Unit (OU) in Active Directory in which to store the group. You can specify an OU in Distinguished Name format (e.g. OU=Target OU,OU=London,DC=mydomain,DC=local), GUID format or as a path (e.g. MyGroups\London). If this is left blank, the group will be created in the 'Users' OU.

The primary return email address that is used for the new group.

Allows you to specify restrictions on a member leaving a distribution group. 'Open' is the default and allows members to leave the group without approval, 'Closed' restricts members from leaving the group. This option is ignored for security groups since users cannot remove themselves from security groups.

Allows you to specify restrictions on a member joining a distribution group after it has been created. 'Open' allows members to join the group without approval, 'Closed' (the default) restricts members from joining the group, 'ApprovalRequired' allows a member to request joining the group and they are added if a group owner accepts the request. This option is ignored for security groups since users cannot add themselves to security groups.

Set to true to specify that the group will only accept messages from authenticated (internal) senders. Set to false to accept messages from all senders.

Specify the type of group to create. 'Distribution' is the default and creates a distribution group. 'Security' is used to create a mail-enabled security group.

Should an exception occur if the group already exists? Set to false to simply do nothing if the group already exists (e.g. it has already been created). Set to true if the group already existing is an error (i.e. it was not expected to exist).

Add the following expression here: workflow()

The unique name for the new group.

The alias (also known as mail nickname) for the new group. If you don't specify a SMTP address, the alias will be used to generate the name component of the email address (e.g. [email protected]).

The display name of the group. This is visible in address lists.

Optional notes about the object.

The owner of the group. If you don't specify an owner, the user that created the group will become the owner. The owner can be a mailbox, mail user or mail-enabled security group. You can specify a mailbox by Name, Alias, Object Id (e.g. UUID/GUID value), Email address, GUID, SAMAccountName (even users in non Active Directory connected environments have a SAMAccountName) or User Principal Name (UPN).

A comma separated list of members to add to the new group. You can specify members by Name, Alias, Distinguished Name (e.g. CN=MyGroup,OU=My Groups,DC=mydomain,DC=local), Email address or GUID.

The Organizational Unit (OU) in Azure Active Directory in which to store the group. You can specify an OU in Distinguished Name format (e.g. OU=Target OU,OU=London,DC=mydomain,DC=local) or GUID format.

The primary return email address that is used for the new group.

Allows you to specify restrictions on a member leaving the group. 'Open' is the default and allows members to leave the group without approval, 'Closed' restricts members from leaving the group.

Allows you to specify restrictions on a member joining the group after it has been created. 'Open' allows members to join the group without approval, 'Closed' (the default) restricts members from joining the group, 'ApprovalRequired' allows a member to request joining the group and they are added if a group owner accepts the request.

Set to true to specify that the group will only accept messages from authenticated (internal) senders. Set to false to accept messages from all senders.

Specify the type of group to create. 'Distribution' is the default and creates a distribution group. 'Security' is used to create a mail-enabled security group.

Add the following expression here: workflow()

The user's first name.

The user's last name / surname.

The Organisation Unit (OU) in which to store the user in Distinguished Name format (e.g. OU=Target OU,OU=London,DC=mydomain,DC=local), GUID format or as a path (e.g. MyUsers\London). If this is left blank, the user will be created in the 'Users' OU.

The name of the Active Directory user. This appears in the 'Name' column in AD users and computers and in the top of the User 'General' tab. This is not the user logon name.

The optional user display name.

The Exchange alias (also known as mail nickname) for the user. If the email address policy is enabled, this will be used to generate the name component of the Primary SMTP email address (e.g. [email protected]). If the email address policy is not enabled, you may wish to set the primary SMTP address instead.

The primary return email address that is used for the recipient. You are unlikely to be able to set this if the 'Email address policy' is enabled so either use 'Alias' instead (and the policy will create the Primary SMTP address from the alias) or disable the email address policy.

The user logon name in Active Directory. This generally should be in the format 'name@domainFQDN' (e.g. '[email protected]'). The user can logon using this format: name@domainFQDN.

The user logon name (pre-Windows 2000) in Active Directory. This is in the format 'name' (e.g. 'TestUser1'). The user can logon using this format: DOMAIN\name.

The user password. This must be specified and meet the Active Directory password complexity rules. If this is a 'Stored' password, enter in the format {IAConnectPassword:StoredPasswordIdentifier} and set the 'stored password' input to true. If this is an Orchestrator generic credential, enter in the format {OrchestratorCredential:FriendlyName} and set the 'stored password' input to true.

Set to true if the password is an IA-Connect stored password identifier (for example: generated by the 'Generate password' action) or an IA-Connect Orchestrator generic credential (for example: If using IA-Connect with a PA flow).

Set to true if you want to force the user to change their password when they login (i.e. the new password being set here is a one-time password to get the user logged-in). Set to false if this is the password the user will use until they manually change it.

The Exchange database to contain the new database. You can specify the database by Distinguished Name, GUID or Name.

Set to true if the mailbox being created should be a shared mailbox.

Set to true if you want to automatically update email addresses based on the email address policy applied to this recipient. If the email address policy is enabled, this generally will impact your ability to set the primary SMTP address. Set to false to disable the feature, giving you full control to manually setting email addresses. Leave blank if you don't want to set this option (i.e. leave at the existing or default value).

Set to true if you want to additionally create an archive mailbox in Microsoft Exchange Online or Office 365.

Add the following expression here: workflow()

The user's first name.

The user's last name / surname.

The Organisation Unit (OU) in which to store the user in Distinguished Name format (e.g. OU=Target OU,OU=London,DC=mydomain,DC=local), GUID format or as a path (e.g. MyUsers\London). If this is left blank, the user will be created in the 'Users' OU.

The name of the Active Directory user. This appears in the 'Name' column in AD users and computers and in the top of the User 'General' tab. This is not the user logon name.

The optional user display name.

Set this to override the SMTP address of the mailbox in Microsoft Exchange Online or Office 365 that this user is associated with. If you leave this field blank (the default), the remote routing address is automatically calculated based on your directory synchronisation between on-premises and Microsoft Exchange Online.

The Exchange alias (also known as mail nickname) for the user. If the email address policy is enabled, this will be used to generate the name component of the Primary SMTP email address (e.g. [email protected]). If the email address policy is not enabled, you may wish to set the primary SMTP address instead.

The primary return email address that is used for the recipient. You are unlikely to be able to set this if the 'Email address policy' is enabled so either use 'Alias' instead (and the policy will create the Primary SMTP address from the alias) or disable the email address policy.

The user logon name in Active Directory. This generally should be in the format 'name@domainFQDN' (e.g. '[email protected]'). The user can logon using this format: name@domainFQDN.

The user logon name (pre-Windows 2000) in Active Directory. This is in the format 'name' (e.g. 'TestUser1'). The user can logon using this format: DOMAIN\name.

The user password. This must be specified and meet the Active Directory password complexity rules. If this is a 'Stored' password, enter in the format {IAConnectPassword:StoredPasswordIdentifier} and set the 'stored password' input to true. If this is an Orchestrator generic credential, enter in the format {OrchestratorCredential:FriendlyName} and set the 'stored password' input to true.

Set to true if the password is an IA-Connect stored password identifier (for example: generated by the 'Generate password' action) or an IA-Connect Orchestrator generic credential (for example: If using IA-Connect with a PA flow).

Set to true if you want to force the user to change their password when they login (i.e. the new password being set here is a one-time password to get the user logged-in). Set to false if this is the password the user will use until they manually change it.

Set to true if the mailbox being created should be a shared mailbox.

Set to true if you want to automatically update email addresses based on the email address policy applied to this recipient. If the email address policy is enabled, this generally will impact your ability to set the primary SMTP address. Set to false to disable the feature, giving you full control to manually setting email addresses. Leave blank if you don't want to set this option (i.e. leave at the existing or default value).

Set to true if you want to additionally create an archive mailbox in Microsoft Exchange Online or Office 365.

Add the following expression here: workflow()

The identity of the existing user you want to create a mailbox for. You can specify a user by Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), GUID, SID, SAMAccountName / pre-2K name (e.g. 'User1') or Name (e.g. 'User1').

The Exchange alias (also known as mail nickname) for the user. If the email address policy is enabled, this will be used to generate the name component of the Primary SMTP email address (e.g. [email protected]). If the email address policy is not enabled, you may wish to set the primary SMTP address instead.

The display name of the mailbox. This is visible in address lists.

The SMTP address of the mailbox in Microsoft Exchange Online or Office 365 that this user is associated with.

The primary return email address that is used for the recipient. You are unlikely to be able to set this if the 'Email address policy' is enabled so either use 'Alias' instead or disable the email address policy.

Set to true if you want to additionally create an archive mailbox in Microsoft Exchange Online or Office 365.

Set to true if you want to automatically update email addresses based on the email address policy applied to this recipient. If the email address policy is enabled, this generally will impact your ability to set the primary SMTP address. Set to false to disable the feature, giving you full control to manually setting email addresses. Leave blank if you don't want to set this option (i.e. leave at the existing or default value).

Add the following expression here: workflow()

The identity of the Active Directory user. You can specify a user by Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), GUID, SID, SAMAccountName / pre-2K name (e.g. 'User1') or Name (e.g. 'User1').

The optional name or Fully Qualified Domain Name (FQDN) of an Active Directory Domain Controller (DC) to contact to perform the requested action. If left blank, the Active Directory Domain Controller (DC) is automatically determined using site settings.

Add the following expression here: workflow()

The Id of an Azure Active Directory user. You can specify a user by UPN (e.g. [email protected]) or ObjectId (e.g. UUID/GUID value).

Set to true to revoke any refresh tokens issued to the user, which will cause any open sessions to stop working, typically within the hour (when their sessions attempt to use a refresh token to keep their connection alive).

Add the following expression here: workflow()

The identity of the Microsoft Exchange mailbox. You can specify a mailbox by Name, Alias, Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), DOMAIN\username, Email address, GUID, SAMAccountName or User Principal Name (UPN).

Add the following expression here: workflow()

The identity of the Microsoft Exchange Online or Office 365 (remote) mailbox. You can specify a Microsoft Exchange Online or Office 365 (remote) mailbox by Active Directory object Id, Alias, Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), DOMAIN\username, Email address, GUID or User Principal Name (UPN).

Add the following expression here: workflow()

Add the following expression here: workflow()

Add the following expression here: workflow()

Add the following expression here: workflow()

Add the following expression here: workflow()

The identity of the Active Directory group. You can specify a group by Distinguished Name (e.g. CN=Group1,OU=My Groups,DC=mydomain,DC=local), GUID, SID, or SAMAccountName / pre-2K name (e.g. 'Group1'). You cannot use display name or group name (although group name will often be the same as pre-2K name which can be used).

The optional name or Fully Qualified Domain Name (FQDN) of an Active Directory Domain Controller (DC) to contact to perform the requested action. If left blank, the Active Directory Domain Controller (DC) is automatically determined using site settings.

Add the following expression here: workflow()

The identity of the Microsoft Exchange mailbox. You can specify a mailbox by Name, Alias, Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), DOMAIN\username, Email address, GUID, SAMAccountName or User Principal Name (UPN).

As an alternative to searching by identity, provide the name of the property to filter the mailboxes by. Common property names are: Name, Alias, PrimarySMTPAddress, DisplayName, SamAccountName. If using a filter, you also need to populate the 'Filter property comparison' and 'Filter property value' fields.

If searching by 'Filter property name' as an alternative to searching by identity, enter the type of comparison here (for example: If the filter property name is 'Alias', the comparison could be 'equals' or 'like'). If you wish to enter a raw filter (in OPATH format), choose a comparison type of 'Raw: Enter filter manually' and enter the full filter in the 'Filter property value' field.

If searching by filter as an alternative to searching by identity, enter the value of the filter property here (for example: If the filter property name is 'Alias', the filter property value might be 'JohnDoe').

The type of mailbox to search for. If this field is left blank, all types of mailbox will be included in the search.

Add the following expression here: workflow()

The identity of the Microsoft Exchange Online or Office 365 (remote) mailbox. You can specify a Microsoft Exchange Online or Office 365 (remote) mailbox by Active Directory object Id, Alias, Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), DOMAIN\username, Email address, GUID or User Principal Name (UPN).

As an alternative to searching by identity, provide the name of the property to filter the mailboxes by. Common property names are: Name, Alias, PrimarySMTPAddress, DisplayName. If using a filter, you also need to populate the 'Filter property comparison' and 'Filter property value' fields.

If searching by filter as an alternative to searching by identity, enter the type of comparison here (for example: If the filter property name is 'Alias', the comparison could be 'equals' or 'like'). If you wish to enter a raw filter (in OPATH format), choose a comparison type of 'Raw: Enter filter manually' and enter the full filter in the 'Filter property value' field.

If searching by filter as an alternative to searching by identity, enter the value of the filter property here (for example: If the filter property name is 'Alias', the filter property value might be 'JohnDoe').

Add the following expression here: workflow()

The identity of the Active Directory user. You can specify a user by Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), GUID, SID, SAMAccountName / pre-2K name (e.g. 'User1') or Name (e.g. 'User1').

The optional name or Fully Qualified Domain Name (FQDN) of an Active Directory Domain Controller (DC) to contact to perform the requested action. If left blank, the Active Directory Domain Controller (DC) is automatically determined using site settings.

Add the following expression here: workflow()

The Id of an Azure Active Directory user. You can specify a user by UPN (e.g. [email protected]) or ObjectId (e.g. UUID/GUID value).

Add the following expression here: workflow()

The search user's Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local).

Add the following expression here: workflow()

The optional name or Fully Qualified Domain Name (FQDN) of an Active Directory Domain Controller (DC) to send the domain request to. The domain controller will then obtain the requested information for the specified domain.

User: Information will be retrieved for the domain the currently logged in user belongs to. Computer: Information will be retrieved for the domain the computer (on which the IA-Connect session is running on) belongs to. Manual: Enter the Active Directory Domain in the 'Domain identity' field. If this field is blank and the 'Domain identity' field has a value, that value will be used.

This field is only used if the 'Predefined Domain identity' is set to 'Manual' (or blank). The identity of an Active Directory domain to retrieve domain information for. You can specify an Active Directory domain by Distinguished Name (e.g. DC=mydomain,DC=local), GUID, SID, DNS domain name (e.g. mydomain.local) or NetBIOS name (e.g. MYDOMAIN).

Add the following expression here: workflow()

The identity of the Active Directory group. You can specify a group by Distinguished Name (e.g. CN=Group1,OU=My Groups,DC=mydomain,DC=local), GUID, SID, or SAMAccountName / pre-2K name (e.g. 'Group1'). You cannot use display name or group name (although group name will often be the same as pre-2K name which can be used).

As an alternative to searching by identity, provide the name of the property to filter the groups by. Common property names for a group search are: name, description, samaccountname.

If searching by filter as an alternative to searching by identity, enter the type of comparison here (for example: If the filter property name is 'Alias', the comparison could be 'equals' or 'like'). If you wish to enter a raw filter (in OPATH format), choose a comparison type of 'Raw: Enter filter manually' and enter the full filter in the 'Filter property value' field. If you wish to enter an LDAP filter, choose a comparison type of 'LDAP: Enter LDAP filter' and enter the full filter in the 'Filter property value' field.

As an alternative to searching by identity, the value of the 'Filter property name' to filter the groups by.

The top-level Organization Unit (OU) to search under. Only supported when searching using a filter, not by identity. If not specified, the entire domain is searched. The OU can be specified in Distinguished Name format (e.g. OU=London,OU=MyGroups,DC=mydomain,DC=local), GUID format or as a path (e.g. MyGroups\London).

If set to true (the default) and a search OU base is provided, the search OU base and all sub-OUs will be searched. If set to false and a search OU base is provided, only the search OU base will be searched. This input is not used if a search OU base is not provided, or if you are searching by identity.

If set to true and the group does not exist, an exception will be raised. If set to false and the group does not exist, the action will report success but the output will report that no groups were found.

The optional name or Fully Qualified Domain Name (FQDN) of an Active Directory Domain Controller (DC) to contact to perform the requested action. If left blank, the Active Directory Domain Controller (DC) is automatically determined using site settings.

Add the following expression here: workflow()

The identity of the Active Directory group. You can specify a group by Distinguished Name (e.g. CN=Group1,OU=My Groups,DC=mydomain,DC=local), GUID, SID, or SAMAccountName / pre-2K name (e.g. 'Group1'). You cannot use display name or group name (although group name will often be the same as pre-2K name which can be used).

If set to false (the default), only direct members of the group will be returned. If set to true, direct members and members of members will be returned, essentially returning all AD members at all levels.

The optional name or Fully Qualified Domain Name (FQDN) of an Active Directory Domain Controller (DC) to contact to perform the requested action. If left blank, the Active Directory Domain Controller (DC) is automatically determined using site settings.

Add the following expression here: workflow()

The search user's Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local).

Add the following expression here: workflow()

The identity of the Active Directory user. You can specify a user by Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), GUID, SID, SAMAccountName / pre-2K name (e.g. 'User1') or Name (e.g. 'User1').

As an alternative to searching by identity, provide the name of the property to filter the users by. Common property names are: city, company, country, department, description, displayname, division, emailaddress, enabled, givenname, homedirectory, homedrive, homephone, initials, manager, office, organization, postalcode, profilepath, samaccountname, scriptpath, state, streetaddress, surname, title, userprincipalname.

If searching by filter as an alternative to searching by identity, enter the type of comparison here (for example: If the filter property name is 'Alias', the comparison could be 'equals' or 'like'). If you wish to enter a raw filter (in OPATH format), choose a comparison type of 'Raw: Enter filter manually' and enter the full filter in the 'Filter property value' field. If you wish to enter an LDAP filter, choose a comparison type of 'LDAP: Enter LDAP filter' and enter the full filter in the 'Filter property value' field.

As an alternative to searching by identity, the value of the 'Filter property name' to filter the users by.

The top-level Organization Unit (OU) to search under. Only supported when searching using a filter, not by identity. If not specified, the entire domain is searched. The search base OU can be specified in Distinguished Name format (e.g. OU=London,OU=MyUsers,DC=mydomain,DC=local), GUID format or as a path (e.g. MyUsers\London).

If set to true (the default) and a search OU base is provided, the search OU base and all sub-OUs will be searched. If set to false and a search OU base is provided, only the search OU base will be searched. This input is not used if a search OU base is not provided, or if you are searching by identity.

A comma separated list of additional user properties to retrieve. Common properties include: city, company, country, department, description, displayname, division, emailaddress, enabled, givenname, homedirectory, homedrive, homephone, initials, manager, office, organization, postalcode, profilepath, samaccountname, scriptpath, state, streetaddress, surname, title, userprincipalname. If you leave this field blank, a default set of properties are returned.

The optional name or Fully Qualified Domain Name (FQDN) of an Active Directory Domain Controller (DC) to contact to perform the requested action. If left blank, the Active Directory Domain Controller (DC) is automatically determined using site settings.

Some properties (in the PowerShell return results) are collections of values (e.g. an array or table) and by default are not returned in the IA-Connect PowerShell response. This option allows you to specify which properties IA-Connect should attempt to return as a collection and can be entered in JSON or CSV format. For example: To return the EmailAddresses and MemberOf array properties, enter [{"PropertyName": "EmailAddresses"}, {"PropertyName": "MemberOf"}] (JSON table format), ["EmailAddresses", "MemberOf"] (JSON array format), or EmailAddresses,MemberOf (CSV format).

Add the following expression here: workflow()

The user to query for group membership. You can specify a user by Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), GUID, SID, SAMAccountName / pre-2K name (e.g. 'User1') or Name (e.g. 'User1').

The optional name or Fully Qualified Domain Name (FQDN) of an Active Directory Domain Controller (DC) to contact to perform the requested action. If left blank, the Active Directory Domain Controller (DC) is automatically determined using site settings.

Add the following expression here: workflow()

The Id of an Azure Active Directory user. You can specify a user by UPN (e.g. [email protected]) or ObjectId (e.g. UUID/GUID value).

A comma separated list (CSV) of all member properties to return (retrieve). If blank (the default), IA-Connect will return AccountEnabled, DirSyncEnabled, DisplayName, Mail, MailNickName, ObjectId, ObjectType, SecurityEnabled, UserPrincipalName. Enter * to receive all properties.

A comma separated list (CSV) of all member object types to return (retrieve). If blank (the default), IA-Connect will return all member object types which can be one or more of the following: User,Group,Device,ServicePrincipal.

Add the following expression here: workflow()

The object Id of an Azure Active Directory group to search for. You can specify a group by Display Name (e.g. "Finance users") or ObjectId (e.g. UUID/GUID value).

As an alternative to searching by group object Id, provide the name of the property to filter the groups by. Common group property names are: Description, DisplayName and Mail. If using a filter, you also need to populate the 'Filter property comparison' and 'Filter property value' fields.

If searching by filter as an alternative to searching by group object Id, enter the type of comparison here (for example: If the filter property name is 'DisplayName', the comparison could be 'equals' or 'starts with'). If you wish to enter a raw filter (in ODATA 3 format), choose a comparison type of 'Raw: Enter filter manually' and enter the full filter in the 'Filter property value' field.

If searching by filter as an alternative to searching by group object Id, enter the value of the filter property here (for example: If the filter property name is 'DisplayName', the filter property value might be 'London users').

Set to true to raise an exception if no groups are found. Set to false to simply report a count of 0 if no groups are found. Note the 'false' option may not work when used with Identity in non-English languages so consider searching using filters instead.

A comma separated list (CSV) of all group properties to return (retrieve). If blank (the default), IA-Connect will return a default set of common group properties. If using the Microsoft Graph Users PowerShell modules, the input allows you to both limit the returned properties or return additional properties. If using Azure AD v2, the input only allows you to limit the returned properties.

Add the following expression here: workflow()

An optional license property to expand and include in the output. If you expand 'PrepaidUnits', license information including the total number of enabled licenses will be included in the output. If you expand 'ServicePlans', each individual service plan within a Sku will be returned as a separate output line item. You can only expand one property at a time.

Add the following expression here: workflow()

The Id of an Azure Active Directory user. You can specify a user by UPN (e.g. [email protected]) or ObjectId (e.g. UUID/GUID value).

If set to true, the IA-Connect Agent will retrieve the names of each role in addition to the role Ids. This takes longer, but provides more readable information. If set to false, the IA-Connect Agent will not retrieve role names.

If set to true, the IA-Connect Agent will retrieve the assignment Ids for each role assignment. Assignment Ids are only needed if you intend to perform some custom actions on the role assignment (instead of using built-in IA-Connect actions).

Add the following expression here: workflow()

The Id of an Azure Active Directory user. You can specify a user by UPN (e.g. [email protected]) or ObjectId (e.g. UUID/GUID value).

A comma separated list (CSV) of all group properties to return (retrieve). If blank (the default), IA-Connect will return all group properties.

Add the following expression here: workflow()

The Id of an Azure Active Directory user. You can specify a user by UPN (e.g. [email protected]) or ObjectId (e.g. UUID/GUID value).

The part number of the license SKU. For example: FLOW_FREE or SPE_E3.

Add the following expression here: workflow()

The Id of an Azure Active Directory user. You can specify a user by UPN (e.g. [email protected]) or ObjectId (e.g. UUID/GUID value).

Add the following expression here: workflow()

The object Id of an Azure Active Directory user to search for. You can specify a user by UPN (e.g. [email protected]) or ObjectId (e.g. UUID/GUID value).

As an alternative to searching by user object Id, provide the name of the property to filter the users by. Common property names are: UserPrincipalName and DisplayName. If using a filter, you also need to populate the 'Filter property comparison' and 'Filter property value' fields.

If searching by filter as an alternative to searching by user object Id, enter the type of comparison here (for example: If the filter property name is 'UserPrincipalName', the comparison could be 'equals' or 'starts with'). If you wish to enter a raw filter (in ODATA 3 format), choose a comparison type of 'Raw: Enter filter manually' and enter the full filter in the 'Filter property value' field.

If searching by filter as an alternative to searching by user object Id, enter the value of the filter property here (for example: If the filter property name is 'UserPrincipalName', the filter property value might be '[email protected]').

Set to true to raise an exception if no users are found. Set to false to simply report a count of 0 if no mailboxes are found. Note the 'false' option may not work when used with Identity in non-English languages so consider searching using filters instead.

A comma separated list of user properties to return (retrieve). Common properties include: AccountEnabled, City, CompanyName, Country, Department, DisplayName, GivenName, JobTitle, PostalCode, State, StreetAddress, Surname, UserPrincipalName. If you leave this field blank, a default set of properties are retrieved. If you specify properties to retrieved, only those properties will be retrieved. Has no effect if using the Azure AD v2 PowerShell modules.

Add the following expression here: workflow()

The identity of the distribution group to search for. You can specify a distribution group by Name, Alias, Distinguished Name (e.g. CN=MyGroup,OU=My Groups,DC=mydomain,DC=local), Email address or GUID.

Add the following expression here: workflow()

The user's first name. Leave blank if a user's first name is not used to construct account names (rare).

The user's middle name (optional). Leave blank if a user's middle name is not used to construct account names.

The user's last / family / sur name. Leave blank if a user's last name is not used to construct account names.

An additional field used to construct account names. Leave blank if no additional fields are required to construct an account name.

An additional field used to construct account names. Leave blank if no additional fields are required to construct an account name.

An additional field used to construct account names. Leave blank if no additional fields are required to construct an account name.

An additional field used to construct account names. Leave blank if no additional fields are required to construct an account name.

Optionally allows you to set the initial value for the {M} variable which can be used in the property format to represent a variable which increases with each iteration.

Optionally allows you to set the initial value for the {N} variable which can be used in the property format to represent a variable which increases with each iteration.

Optionally allows you to set the initial value for the {X} variable which can be used in the property format to represent a variable which increases with each iteration.

The maximum number of attempts (trying different values) before IA-Connect gives up trying to find an available account.

If set to true: If any availability check for any rule requires falling back to a different format, tests will re-start from the top of the list to ensure that all properties use the same format (e.g. primary, primary, primary or fallback, fallback, fallback). This keeps the results in sync and is the recommended value. Only set to false if you know exactly what you are doing.

A comma separated list of numbers not to use for values of M, N or X. For example: '13, 666'.

A string containing all of the characters you wish to remove from the inputs (for example if a user's name contains invalid characters). For example: !@&?^*.

If set to true, IA-Connect will attempt to remove all diacritics from the input fields, replacing characters with a diacritic with the same character minus the diacritic. For example: replacing 'acute accented a' with 'a'. In scenarios where there is no direct mapping to a simple character, the character is removed. For example: The German sharp S is removed.

If set to true, IA-Connect will remove all non-alphanumeric characters from the input fields.

A comma separated list of strings to use for the {A1} variable which can be used in the property format to represent a value which changes with each attempt to find an available account. For example: If you specify 'A,B,C,D,E,F' for this value, the format '{FirstName}{A1}' would check the availability of {FirstName}A followed by {FirstName}B etc.

Which account property to check for availability

The format for the value of this property. For example: {FirstName}.{LastName} or {FirstName first 1}.{LastName}

The fallback format for the value of this property if the value is already taken. For example: {FirstName}.{LastName}{NN} or {FirstName first 1}.{LastName}{NN}

The second fallback format for the value of this property if the value and first fallback is already taken. For example: {FirstName}.{LastName}{NN} or {FirstName first 1}.{LastName}{NN}

The maximum length for the value of this field before something has to be cut

If the maximum length for the value of this field is exceeded, which input should be cut. For example: Choose LastName if you want to cut from the Last name / family name / surname to shorten the property value.

Add the following expression here: workflow()

The identity of the distribution group or mail-enabled security group. You can specify a distribution group by Name, Alias, Distinguished Name (e.g. CN=MyGroup,OU=My Groups,DC=mydomain,DC=local), Email address or GUID.

As an alternative to searching by identity, provide the name of the property to filter the distribution groups by. Common property names are: DisplayName, Name, GroupType, PrimarySMTPAddress. If using a filter, you also need to populate the 'Filter property comparison' and 'Filter property value' fields.

If searching by filter as an alternative to searching by identity, enter the type of comparison here (for example: If the filter property name is 'Alias', the comparison could be 'equals' or 'like'). If you wish to enter a raw filter (in OPATH format), choose a comparison type of 'Raw: Enter filter manually' and enter the full filter in the 'Filter property value' field.

If searching by filter as an alternative to searching by identity, enter the value of the filter property here (for example: If the filter property name is 'Alias', the filter property value might be 'JohnDoe').

Set to true to raise an exception if no distribution groups are found. Set to false to simply report a count of 0 if no distribution groups are found. Note the 'false' option may not work when used with Identity in non-English languages so consider searching using filters instead.

Add the following expression here: workflow()

The identity of the distribution group to search for. You can specify a distribution group by Name, Alias, Distinguished Name (e.g. CN=MyGroup,OU=My Groups,DC=mydomain,DC=local), Email address or GUID.

A list of member properties to retrieve, in JSON or CSV format. For example: ["Identity", "DistinguishedName"] (JSON array format), or "Identity","DistinguishedName" (CSV format). Common member properties include: Alias, DisplayName, DistinguishedName, Identity, Name, PrimarySMTPAddress, RecipientType and SamAccountName. If you leave this field blank, a default set of properties are retrieved.

Add the following expression here: workflow()

The Id of a Microsoft Exchange Online or Office 365 mailbox. You can specify a mailbox by Name, Alias, Object Id (e.g. UUID/GUID value), Email address, GUID, SAMAccountName (even users in non Active Directory connected environments have a SAMAccountName) or User Principal Name (UPN).

As an alternative to searching by identity, provide the name of the property to filter the mailboxes by. Common property names are: Name, Alias, PrimarySMTPAddress, DisplayName, SamAccountName. If using a filter, you also need to populate the 'Filter property comparison' and 'Filter property value' fields.

If searching by filter as an alternative to searching by identity, enter the type of comparison here (for example: If the filter property name is 'Alias', the comparison could be 'equals' or 'like'). If you wish to enter a raw filter (in OPATH format), choose a comparison type of 'Raw: Enter filter manually' and enter the full filter in the 'Filter property value' field.

If searching by filter as an alternative to searching by identity, enter the value of the filter property here (for example: If the filter property name is 'Alias', the filter property value might be 'JohnDoe').

The type of mailbox to search for. If this field is left blank, all types of mailbox will be included in the search.

Set to true to raise an exception if no mailboxes are found. Set to false to simply report a count of 0 if no mailboxes are found. Note the 'false' option may not work when used with Identity in non-English languages so consider searching using filters instead.

Add the following expression here: workflow()

Add the following expression here: workflow()

The Id of an Azure Active Directory user. You can specify a user by UPN (e.g. [email protected]) or ObjectId (e.g. UUID/GUID value).

The Id or display name of an Azure Active Directory admin role. You can specify an AAD admin role by Display Name (e.g. "Application Developer") or ObjectId (e.g. UUID/GUID value).

Add the following expression here: workflow()

Add the following expression here: workflow()

Add the following expression here: workflow()

If set to false: IA-Connect will not issue a test command to confirm the Exchange server connection is functional and will rely on the last-known state. If set to true (the default): IA-Connect will issue a test command to confirm the Exchange server connection is functional.

Add the following expression here: workflow()

If set to false: IA-Connect will not issue a test command to confirm the Office 365 Exchange Online connection is functional and will rely on the last-known state. If set to true (the default): IA-Connect will issue a test command to confirm the Office 365 Exchange Online connection is functional.

Add the following expression here: workflow()

The Id of an Azure Active Directory user. You can specify a user by UPN (e.g. [email protected]) or ObjectId (e.g. UUID/GUID value).

The Id or display name of an Azure Active Directory group. You can specify a group by Display Name (e.g. "Finance users") or ObjectId (e.g. UUID/GUID value).

Add the following expression here: workflow()

The identity of the Microsoft Exchange mailbox. You can specify a mailbox by Name, Alias, Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), DOMAIN\username, Email address, GUID, SAMAccountName or User Principal Name (UPN).

The Exchange alias (also known as mail nickname) for the user. If the email address policy is enabled, this will be used to generate the name component of the Primary SMTP email address (e.g. [email protected]). If the email address policy is not enabled, you may wish to set the primary SMTP address instead. Leave blank if you don't want to change the current value.

The primary return email address that is used for the recipient. You are unlikely to be able to set this if the 'Email address policy' is enabled so either use 'Alias' instead (and the policy will create the Primary SMTP address from the alias) or disable the email address policy. Leave blank if you don't want to change the current value.

Set to true if you want to automatically update email addresses based on the email address policy applied to this recipient. If the email address policy is enabled, this generally will impact your ability to set the primary SMTP address. Set to false to disable the feature, giving you full control to manually setting email addresses. Leave blank if you don't want to set this option (i.e. leave at the existing or default value).

A list of additional (non-primary) email addresses to assign to the mailbox.

Set to true if you want the supplied list of email addresses to replace all existing email addresses (not including the Primary SMTP address). Set to false if you want the supplied list of email addresses to add to any existing addresses.

A list of additional (non-primary) email addresses to remove from the mailbox (if they are present). This only has a purpose if 'Replace email addresses' is set to false or if you aren't adding any email addresses.

Add the following expression here: workflow()

The identity of the Microsoft Exchange Online or Office 365 (remote) mailbox. You can specify a Microsoft Exchange Online or Office 365 (remote) mailbox by Active Directory object Id, Alias, Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), DOMAIN\username, Email address, GUID or User Principal Name (UPN).

The Exchange alias (also known as mail nickname) for the user. If the email address policy is enabled, this will be used to generate the name component of the Primary SMTP email address (e.g. [email protected]). If the email address policy is not enabled, you may wish to set the primary SMTP address instead. Leave blank if you don't want to change the current value.

The primary return email address that is used for the recipient. You are unlikely to be able to set this if the 'Email address policy' is enabled so either use 'Alias' instead (and the policy will create the Primary SMTP address from the alias) or disable the email address policy. Leave blank if you don't want to change the current value.

Set to true if you want to automatically update email addresses based on the email address policy applied to this recipient. If the email address policy is enabled, this generally will impact your ability to set the primary SMTP address. Set to false to disable the feature, giving you full control to manually setting email addresses. Leave blank if you don't want to set this option (i.e. leave at the existing or default value).

A list of additional (non-primary) email addresses to assign to the mailbox.

Set to true if you want the supplied list of email addresses to replace all existing email addresses (not including the Primary SMTP address). Set to false if you want the supplied list of email addresses to add to any existing addresses.

A list of additional (non-primary) email addresses to remove from the mailbox (if they are present). This only has a purpose if 'Replace email addresses' is set to false or if you aren't adding any email addresses.

Add the following expression here: workflow()

The identity of the Active Directory user. You can specify a user by Distinguished Name (e.g. CN=User1,OU=My Users,DC=mydomain,DC=local), GUID, SID, SAMAccountName / pre-2K name (e.g. 'User1') or Name (e.g. 'User1').

The user's 'City' property (in the 'Address' tab in AD users and computers).

The user's 'Company' property (in the 'Organization' tab in AD users and computers).

The user's 'Country' property (in the 'Address' tab in AD users and computers). This must be a two character country code (e.g. GB for United Kingdom, US for United States, FR for France, ES for Spain, JP for Japan).

The user's 'Department' property (in the 'Organization' tab in AD users and computers).

The user's 'Description' property (in the 'General' tab in AD users and computers).

The user's display name (in the 'General' tab in AD users and computers).

The user's 'E-mail' property (in the 'General' tab in AD users and computers).

The user's first name (in the 'General' tab in AD users and computers).

The user's 'Home' phone number property (in the 'Telephones' tab in AD users and computers).

The user's initials (in the 'General' tab in AD users and computers).

The user's 'IP phone' property (in the 'Telephones' tab in AD users and computers).

The user's Manager property (in the 'Organization' tab in AD users and computers). You can specify a Manager in Distinguished Name format (e.g. CN=MrBig,OU=London,DC=mydomain,DC=local), GUID format, SID or SAMAccountName (e.g. 'MrBig').

The user's 'Mobile' phone number property (in the 'Telephones' tab in AD users and computers).

The user's 'Notes' property (in the 'Telephones' tab in AD users and computers).

The user's 'Office' property (in the 'General' tab in AD users and computers).

The user's 'Telephone number' property (in the 'General' tab in AD users and computers).

The user's 'Zip/Postal Code' property (in the 'Address' tab in AD users and computers).

The user's 'Profile path' property (in the 'Profile' tab in AD users and computers).

The user's 'Logon script' property (in the 'Profile' tab in AD users and computers).

The user's 'State / province' property (in the 'Address' tab in AD users and computers).