Microsoft Online Rule Reference

Microsoft Online uses the internal service name MSOL. Its rules inherit the standard customer-service or user-service request contract and add Microsoft-specific values under ServiceProperties.

Prerequisite

The customer's internal Azure AD service (Microsoft Entra ID integration) must be successfully provisioned before Atria can execute Microsoft Online operations for that tenant.

Rule locations

Common extension points are:

Event$Customer Service$MSOL$After Provision
Event$Customer Service$MSOL$Before Deprovision
Event$User Service$MSOL$After Provision
Event$User Service$MSOL$Before Deprovision

The entire service lifecycle is available. Use After Provision for changes that require the tenant, user, or licence operation to have completed. Use Before Deprovision when custom data must be collected or removed before the standard object is disconnected.

Base values

MSOL customer-service rules include all customer-service properties. MSOL user-service rules include all user-service properties.

Frequently used top-level values are:

Customer service	User service
{CustomerID}	{CustomerID}
{CustomerShortName}	{UserID}
{CustomerLongName}	{Username}
{PrimaryDomain}	{UserEmail}
{ServiceProperties}("WebServiceConnection")	{ServiceProperties}("UsageLocation")
{ServiceObjectID}	{UserServiceObjectID}

MSOL customer-service properties

Service property	Shape	Availability and use
WebServiceConnection	Object	Added by the MSOL customer provider for both provision and deprovision. Pass it only to MSOL actions that expect the connection object.
IsCustomerServiceDeprovisioning	Boolean	Service state used to distinguish customer-service disconnection from ordinary user-service removal.

Additional values defined by the effective MSOL/Azure AD service configuration can also appear in ServiceProperties. The standard rules currently consume keys including Tenant, Agreement, Domains, IsConnecting, RemoveRelationShip, and SuspendSubscriptions in the relevant connector or service flow. Treat these as flow-specific and confirm their presence in a journalled request before using them in a custom rule.

Read the connection object in an action parameter as:

{ServiceProperties}("WebServiceConnection")

Do not render this object into a string or log it.

MSOL user-service properties

The MSOL user provider adds the following keys to ServiceProperties:

Service property	Shape	Provision	Deprovision	Description
WebServiceConnection	Object	Yes	Yes	MSOL web-service connection object.
IsCustomerServiceDeprovisioning	Boolean	Yes	Yes	Whether the parent customer service is being removed.
Offers	JSON string	Yes	Yes	Serialised licence/offer provisioning payload.
UserProperties	Hashtable	Yes	Yes	User Active Directory attributes copied into the service-property bag.
UsageLocation	String	Yes	Yes	Country code from the customer connector.
UserExistInRecyclingBinAction	String	Yes	Yes	Configured action for a matching recycled user.
PartnerCenterUserId	String	Yes	Yes	Partner Center user identifier, when known.
UserPrincipalName	String	Yes	No	Target UPN. It can be blank during multi-user provisioning.
TempPassword	Protected value	Yes	No	Temporary password. Pass only to an action designed to accept it; never log it.
ConvertToSharedMailbox	Boolean	Yes	No	Whether the mailbox should be converted to shared.
RemoveEmailAliases	Boolean	Yes	No	Whether aliases should be removed as part of the operation.
EmailAliasesToKeep	String array	Yes	No	Aliases exempted from removal; CORE initially supplies an empty array.
RemoveDelegatedPermissions	Boolean	Yes	No	Whether delegated permissions should be removed.
LicenseDetails	String	Yes	No	Display/diagnostic licence detail.
IsLicenseRequested	Boolean	Yes	No	Whether a licence has been requested.
EnabledUserPlans	JSON string	Yes	No	Serialised selected user plans.

Examples:

{ServiceProperties}("UsageLocation")
{ServiceProperties}("UserPrincipalName")
{ServiceProperties}("IsLicenseRequested")

Provision-only condition:

Not String.IsNullOrEmpty({ServiceProperties}("UserPrincipalName")) AndAlso
CBool({ServiceProperties}("IsLicenseRequested"))

Run a Microsoft 365 script

For tenant or user automation, use MSOL Run Customer Script or MSOL Run User Script instead of inserting connection commands into Powershell Execute.

The MSOL actions can connect Exchange Online, Microsoft Graph PowerShell, Partner Center, or legacy AzureAD/MSOnline modules. They always supply $RequestProperties and $CustomerId; connector-backed runs can also supply $TenantId, $UserId, $UserAzureId, or $GraphToken. Named action mappings become additional PowerShell variables.

See Run Microsoft Online scripts for the exact connection keywords, timeout units, parameter mapping, and worked examples.

Deprovision safely

When a customer MSOL service is removed, its user services can be deprovisioned as part of that larger operation. Check:

{ServiceProperties}("IsCustomerServiceDeprovisioning")

before deciding whether a user-level custom action should remove a user, only remove licences, or do nothing because tenant-level cleanup owns the operation.

Never assume provision-only values such as TempPassword or EnabledUserPlans are present during deprovision.