Membership refresh, onboarding, and mailbox reset
Membership refresh and mailbox lifecycle actions enforce separate permissions. Prepare external services and Microsoft Graph access before these operations.
Automatic membership refresh
Saving a license-based rule immediately evaluates tenant members against the latest successful directory/license projection. The response separates matched, added, and revoked memberships.
A durable job then refreshes the Microsoft directory projection and evaluates all active rules for the affected group. HTTP entitlements run with bounded concurrency.
| State | Meaning |
|---|---|
Refreshing | Background refresh runs |
Completed | All affected rules finished checks |
Partially unavailable | At least one external source could not establish evidence |
Membership changes send authorization events. BFF invalidates the affected connected Microsoft's permission cache without waiting for the ten-minute cycle.
A source outage differs from proven loss of entitlement. Prior successful evidence can remain valid for at most 24 hours. Proven invalidity revokes immediately.
Global Administrator proof
Missing RoleManagement.Read.Directory admin consent can cause a 403 diagnostic. Onboarding status is separate. After consent, the next admin request checks the role again. An email address or local application role does not prove Microsoft root authority.
Onboarding gate
For an authorized selected Microsoft account without completed onboarding, Mail and Sync Center show a blocking setup dialog. Protected mailbox components and reads do not start behind it.
The dialog identifies the selected account and actual onboarding steps. It offers setup/retry, account switching, and administration when permitted. Success returns to the same workspace URL. Administration remains available without mailbox onboarding because it manages directory and access data separately.
Mailbox reset
This operation deletes MailGen's local copy of a mailbox. It does not modify the Microsoft 365 source. Preserve required local data before requesting it.
admin.storage.resetMailbox depends on admin.storage.read. The target must rank below the operator's highest group. The request needs the expected mailbox UUID, exact typed target email, and an audit reason of at least ten characters.
POST /storage/mailboxes/{graphUserId}/reset
GET /storage/resets/{resetId}
The checkpointed worker processes these stages in order:
- Remove Graph subscriptions.
- Delete local mailbox, Kafka, outbox, schedule, search, and onboarding state.
- Delete current S3 objects, versions, and delete markers for the verified mailbox scope.
- Delete and check OpenSearch mailbox documents through
delete_by_query. - Finalize and set onboarding to
notStarted.
A generation fence closes the mailbox at reset acceptance. Pending work becomes superseded. A failed reset can resume the same operation from the last successful checkpoint. Object Lock, legal hold, or missing deletion authority produces blocked, never successful completion.
The app login, Microsoft account link, authorization subject, groups, licenses, audit history, and tenant contact projection remain.
The administrator sees aggregate usage and reset status. A dedicated server identity performs deletion. Administrator and EcasRoot roles do not expose S3 credentials or object contents.
Structured settings editors
Policy values use graphical editors for schedule templates, shortcuts, action order, and trusted senders. Editors also cover panel/sidebar sizes, saved views, recent searches, tutorial state, and per-account initial folders.
Advanced JSON is a secondary collapsed view of the same draft. Both paths validate with UserSettingsSchema. One Save changes action atomically stores changes across pages and filters.
On mobile, a full-width Sheet separates scrolling content and actions. Keyboard focus stays visible. Motion indicators respect reduced-motion settings.