contentACCESS documentation – version Orion

The provisioning job

• Synchronizes the Exchange server objects specified on the Provisioning settings page to the contentACCESS Address book
• Verifies the user’s permissions on the mailboxes on the Exchange server and synchronizes these permissions to contentACCESS
• If contentACCESS Portal user creation is turned on in the Address book for an object (Exchange mailbox/group/server), it creates a contentACCESS Portal user for mailboxes with an authentication type Windows, Microsoft 365 or Microsoft Exchange based on the EWS settings (for more info please refer to Email archive System settings, section EWS settings)
• If contentACCESS MailApp activation is allowed (or inherited from parent group/server), it activates contentACCESS MailApp for the selected mailbox/group/server
• Based on the roles assigned in the Address book, it gives permissions on the specific archive mailbox(es)

The mailbox provisioning job is an elementary job, which is intended to extract Exchange groups and subgroups from the Exchange server and synchronize their changes with contentACCESS. For example, if a new user has been added to an Exchange group which is under archiving process, the provisioning job will “point out” this change and the mailbox of this new user will be crawled/archived automatically. Provisioning job will synchronize the mailbox permissions as well.

In contentACCESS, a provisioning job is created automatically when activating email archive for the first time.

Email Archive provisioning settings are available on the Provisioning settings page (Email Archive ⇒ Settings ⇒ Provisioning settings):

The status bar of the provisioning job offers the following options:

If a scheduler has not been selected, the provisioning job can be still started (and also stopped) manually with the “start immediately/stop” control button. For manual refresh of provisioning progress information, click on “refresh” button. To enable/disable auto refresh in every 5 seconds, click on “enable auto refresh”/“disable auto refresh” button. The provisioning job can be also deactivated with the “deactivate job” button. A deactivated job will not start neither automatically, nor can be started manually. The “edit” button is used to select the node, where provisioning job will be run. The user may also rename the provisioning job from here. To view further event details of provisioning job (and also to detect any potential failures/errors in the provisioning events), click on “logs” button. This will redirect you to the System logs page, where the last run of the provisioning job will be preselected, and the last events will be shown in the events table.

With the arrows mark () at the right side of the status bar the user may collapse or expand the progress information about the provisioning job’s running. The status bar’s last state is always stored, and the last state will be opened by navigating to the page again.

The following configuration sections are available on the Provisioning settings page:

1. Force full crawl: The Exchange provisioning job is performing an incremental crawl of the Exchange objects (mailboxes and groups). This means that if an object is not changed, it is not necessary to access it. This makes the provisioning job faster and helps to use less resources. In some situations, however, it is necessary to perform a full crawl of the objects – need to synchronize every object independently, whether it was changed or not from the last synchronization. This can be done with a single click on the „force full crawl“ button, which is located under the status bar of the provisioning job.
2. Scheduling settings: Select the running times of the provisioning job or create a new scheduler. For more information on how to configure scheduler settings please refer to section Schedules described above.
3. Notification settings: If the provisioning job could not run properly due to some reasons, contentACCESS can send a warning about the problem. The notification email message will be sent to the email address that is set here under Recipient list option. Here you can also choose, when these email messages should be sent: only if errors occur, or when errors or warnings occur, or always, regardless of the faultless running of the provisioning job.
4. Exchange servers: click on select option and select the Exchange servers to synchronize from the list of Select Exchange Server dialog.If you select a server, then all mailboxes falling under this server and also all Exchange groups within the organization will be permanently processed by the provisioning job. This will eventually mean that if a server is selected, then it makes no sense to select an Exchange group as well. If all settings are done, click on OK. The selected server can be deleted from its context menu:
   
5. Exchange groups: all users of an Exchange server fall under an Exchange group (or can belong to even more Exchange groups simultaneously). In this section it is possible to specify one or more Exchange groups to be synchronized by the provisioning job.
Group(s) can be
• selected from the list of all groups available on the Exchange – Click on select option and select the groups in the Select Exchange Group dialog’s list (Screenshot 1).
• added manually to the groups to be provisioned – Click on + add and fill the group to the Add Exchange Group dialog. manually (Screenshot 2).
Screenshot 1                                                                   Screenshot 2
Note: If you selected a server one step earlier, then all groups falling under this server will be processed and it makes no sense to select groups as well.
6. Archive settings: This configuration section allows to assign default contentACCESS Portal user roles. The provisioning job will assign the role defined here for the Exchange objects, which are already synchronized to the Address book and contentACCESS Portal user creation is allowed for them (option “Automatically create contentACCESS Portal user” in the Address book). It is recommended to specify here a default role with less contentACCESS Portal permissions, e.g. a role without permissions to recover from the archive. The roles to be assigned must be created on the Roles page.
   
   Important: If there are multiple roles assigned for the same Exchange object (e.g. one role with less permissions in the provisioning settings, another role with more permissions in the Address book), then the following rule applies: The role with more permissions always wins.
   Important: To be able to assign roles using the provisioning job, first the contentACCESS Portal user(s) creation must be allowed in the Address book or inherited from a parent that has contentACCESS Portal user(s) creation allowed, otherwise the role will not be assigned.

   Roles containing Manage system and/or Manage tenant permissions are unavailable in the default roles’ dropdown list. If the role is changed in this configuration section, the next run of the email provisioning job will replace the previously assigned user permissions with the permissions defined in the newly assigned role.

   In the Archive settings configuration section you need to set:

   Mailbox owner role: this is a default role, which will be assigned for the Exchange objects (mailboxes/groups/entire server) if the “Use the role defined in the provisioning job” option is selected for the given Exchange object in the Address book.

   Shared mailboxes role: select a role, which will define the user’s permissions on the shared mailboxes on the Exchange server.

   

   If you check the Assign to mailbox checkbox, 3 dropdowns and the Create contentACCESS Portal user checkbox will appear. With the dropdowns it is possible to select the default Database, Store and Index zone for the mailboxes.

   During the run of the provisioning job, if there are new mailboxes provisioned, the selected Database, Store and Index zone will be automatically assigned to them.

   If you want to assign Database, Store and Index zone to already provisioned mailboxes that don’t have them assigned yet, you need to enable Force full crawl before executing the provisioning job.

   If a database is already assigned to the mailbox, it will not be updated.
   If a store is already assigned to the mailbox, it will not be updated.
   If an index zone is already assigned to the mailbox, it will not be updated.

   If you check the Create contentACCESS Portal user checkbox, then a contentACCESS user will be created with the selected Mailbox owner role in case that Create contentACCESS Portal access is set to Inherit in the Address book for that mailbox AND:

   • the mailbox is not in any group and Create contentACCESS Portal access is not set to Forbidden for the server in Address book, OR
   • for all the groups the mailbox is a member of, the Create contentACCESS Portal access is set to Inherit in Address book and Create contentACCESS Portal access is not set to Forbidden for the server in Address book, OR
   • for at least one of the groups the mailbox is a member of, the Create contentACCESS Portal access is set to Enable

   

   For more information on how to assign explicit permissions for newly created contentACCESS Portal users and how to change these explicit permissions, please refer to chapter Creating contentaccess-portal users.
7. User creation options: In this section, the login type of the users created by the provisioning job is displayed.
   
8. Resource settings: Set the value, which will determine how many items will be processed simultaneously by the provisioning job. The recommended value is “2”.