Cyrill U's questions

Theres a weird issue I can't find any solution for: in an organization that is using GSuite admin can't open a mailbox for a fired employee. I mean we can reset password etc but while logging in there's "Verify its you" prompt that will send sms to his private number - that means mailbox can't be opened. We are legally entitled by organization management to open the mailbox, but it seems quite impossible.

It is not a 2SV - we have disabled it for the whole domain in attempts.

Any workarounds?

I am facing a problem when a migration process from GSuite led to an unconsistent user's mailbox - migration process stopped several times and finally hit mailbox size limit (100Gb) which is much more than expected (~65Gb).

So the mailbox should be cleaned completely and I would like to perform another kind of migration (not API-based, at least - via IMAP or even PST). The problem is I can't find any solution to empty the mailbox.

What I have tried so far:

0. Emptying the mailbox with outlook online - folders are empty, but mailbox usage is about 70Gb (this is probably my mistake - see below)
1. Empty the mailbox using search-mailbox -DelectContent cmdlet - extremely slow, no effect, mailbox usage is about 70Gb
2. Applying set-mailbox -RetainDeletedItemsFor 0 cmdlet - still no effect.

Is there a way like it was in on-prem exchange - disconnecting a mailbox from user and creating a new one from scratch?

I have a weird ADSync error stating that my local active directory contains two objects with the same ProxyAddress property. One of accounts is username@domain.tld (which is correct) and the second is username@domain.onmicrosoft.com (which is inexistent in AD in my opinion) - and, according to DirSync errors report, both of them contain the same conflicting ProxyAddress username@domain.tld. AzureAD shows that both accounts source from local Active Directory. The point is that someone could create *onmicrosoft.com account years ago to test office365.

I have checked two things so far:

1. Small powershell script to test for the same proxyaddress in local AD:

Get-ADUser -Filter * -Properties proxyAddresses | foreach {
    foreach($address in $_.proxyAddresses) {
        if ($address -eq 'smtp:[email protected]') {
            Write-Host $address
        }
    }
 }

2. Checking for immutableIDs of conflicting accounts:

$user = Get-ADUser legit_account
$immutableid = [System.Convert]::ToBase64String($user.ObjectGUID.tobytearray())
$immutableid #shows the same as legit account in DirSync report

$badImmutableID = 'base64 copied from bad account DirSync error report=='


$users = get-aduser -Filter *
foreach ($usr in $users) {
    $currImmutableID = [System.Convert]::ToBase64String($usr.ObjectGUID.tobytearray())
    if ($currImmutableID -eq $badImmutableID) {
        $usr
    }
}

This script provides no output with bad immutableID (but works with others).

I am actually stuck at this point - AzureAD won't let me delete bad account to resolve conflict saying I have to solve it in local AD while there is no such account. Any ideas would be highly appreciated.