Monthly Archives: September 2019

How to set MIM up to use Exchange Online / Office 365 for email

If you want to set the MIM Portal up to use Office 365 for sending email, and you hadn’t previously set it up during installation, you have the option of re-running the MIM installer and setting up the Office 365 details, as described in this helpful post on tlktechidentitythoughts

There are a couple of scenarios where this isn’t possible:

  1. You no longer have the installation media to hand
  2. You do have the installation media to hand, but you have upgraded your environment from FIM to MIM. In this case, you end up in a catch-22 situation, where it complains about it not being for the original version you installed, and if you try the original version, it says you need to run the newer installer.

Thankfully, there is a way to make the change manually without having to run the installer.

The tasks we need to do are:

  1. Change config to make MIM use Exchange Online instead of a local Exchange/SMTP server.
  2. Store an encrypted password for the service account that will be connecting to Exchange Online in the registry key HKLM\SOFTWARE\Microsoft\Forefront Identity Manager\2010\Service\EncryptedExchangeOnlineAccountPassword

Point MIM at Office 365

The first is easy enough – on each of you r MIM Service servers, open the MIM Service config file, Microsoft.ResourceManagement.Service.exe.config, usually located in C:\Program Files\Forefront Identity Manager\Service\

and update the mail server lines as follows:

Encrypt the MIM Service account password

The second is a little tricker, but we can use a handy script provided by Microsoft (copied at the end of this post in case that page ever stops working). The script will work for Group Managed Service Accounts as well as normal service accounts.

Run the script and follow the prompts. It takes the plain text password, encrypts it, and stores it in the necessary registry key.

That’s all.

One tip: if you want to see the emails MIM is sending, but don’t want them to actually be delivered to the named recipients, a good solution is to set up a mailbox, and have your Exchange admin create a mail flow rule to divert all email sent by the MIM service account to the dedicated mailbox. This is really useful for seeing what people would have received without having to change any configuration in MIM or make exceptions in your workflows etc.