Directory Synchronization - Maximum Sync Deletions & Deleted Users

This article contains information on managing Directory Synchronization in Mimecast, focusing on Maximum Sync Deletions and Delete Users options to prevent mail flow issues and manage directory misconfigurations.

Maximum Sync Deletions can help to prevent mail flow issues and manage misconfiguration for users and groups made in your directory. Delete Users helps you automatically remove addresses from your Mimecast account that are no longer being synchronized from your environment. 

This doesn't affect shared mailboxes, as the user is not being removed from Mimecast and there’s no impact on mail flow or archiving.

The Problem

When you synchronize your external Directory with your Mimecast account using a Directory Integration, the extracted addresses display with the type Extracted From Directory. If an address is no longer synchronized via your Directory integration, the address type is updated to Created by Message in Transit. This change is important for the Inbound Check of the Internal domain, as well as for policies that have been configured based on Directory Group membership.

The Inbound Check is one of the first checks that the Mimecast Message Transfer Agent (MTA) performs to ensure that we only accept items for further investigation if they adhere to the Inbound Check that has been configured. It is best practice to set the Inbound Check to Accept inbounds for valid Directory Users Only. This ensures that the Mimecast MTA only accepts items for addresses that have been retrieved from your external Directory.

However, if a misconfiguration is made within your external Directory, a large number of email addresses may no longer be presented for synchronization. The addresses that are no longer being retrieved from your directory will be updated to Created by Message in Transit and they will be removed from all the Directory Groups they were a member of. As a result, the Mimecast MTA would no longer accept items for these addresses, and policies applied to these addresses via group membership would no longer be applied.

The Solution

Maximum Sync Deletions

By default, the Directory integration will only update the address type and group membership of 10 email addresses per sync when they are no longer being presented during the Directory Synchronization. 

If you regularly remove a higher number of addresses from your external Directory, you can update this setting to a higher value. The following values are supported: 0, 5, 10, 20, 50, 100, 300, 500, 1000, 2000, 5000, 10000, 50000, 100000, Unlimited.

To view and edit this option: 

1. Navigate to Users & Groups | Directory Integration.
2. Select an existing integration to edit or create a new one. 
3. Use the wizard to navigate to the Options page.
4. Use the Maximum Sync Deletions drop-down to select your deletion limit per synchronization.

Deleted Users 

If you want to remove the addresses from your Mimecast account instead of their address type and Directory Group membership being updated, you can enable the Delete Users option. This will result in the addresses being added to the Purge List. The value configured for Maximum Sync Deletions represents the maximum number of addresses that will be added to the Purge List.
To enable this option: 

1. Navigate to Users & Groups | Directory Synchronization.
2. Select an existing integration to edit or create a new one. 
3. Use the wizard to navigate through to the Options page.
4. Toggle the Deleted Users switch to enable/disable.

When creating an Azure Active Directory Integration with Delete Users selected, accounts that would have been set to Created by Message in transit will instead be deleted, subject to the limits set in Maximum Sync Deletions. Please note addresses already marked as Created by Message in transit will not be affected. 

To manually remove users, you can purge them through the Internal Directories feature in Mimecast. For detailed instructions, refer to the article titled Directories - Deleting Users from Mimecast. This resource will guide you through the necessary steps to ensure a smooth deletion process.

Audit Logs

You can view Audit Logs for Directory Synchronization, by using the following steps:

1. Log in to the Mimecast Administration Console.
2. Navigate to Account | Audit Logs.
3. In the Filter by field, select Account Logs and click on Apply.
4. Data is displayed for Completed Directory Sync data.

See Also...

• Directory Synchronization - Disabling Users
• Audit Logs