PowerShell: Scripted New User Generation with Exchange Online/365

Greetings All,

I have an automated process for adding users scripted in Powershell. I have a local AD environment with user sync & Azure AD Connect and 100% of my users are in Exchange Online.

My process does the following (very high level):

1). Create the user in AD and fulfills all the dependencies for an AD User (Home Directory Creation, Permissions, Password Generation, Default Attributes, etc).

2). Create the mailbox in Exchange Online.

3). Add users to Security Groups (For Licensing) and Microsoft 365 Groups for Office DL's and General DL's & 365 Groups that New Users require when they're hired.

The problem I have is that in order to add users to the security/licensing groups and email groups I need to have the users mailbox GUID which takes an arbitrary amount of time to generate on Microsoft end.

My solution is not very elegant and sometimes errors out when there's load on Microsoft's servers or I get inconsistent replies from Microsoft's server (the real problem).

At -

Step 2) I run "Enable-RemoteMailbox"

Then I run "Start-ADSyncSyncCycle" Delta sync and wait until it's finished. I have logic to check to make sure the syncer isn't busy and all that good best practice/expected error handling behavior to make sure I wait if other users are running and sync so I've accounted for busy sync'ing and wait until I achieve a successful sync.

Then I add a 60 second sleep (which really shouldn't be necessary but for reasons further revealed below... )

Then I run Get-ExoMailbox using the new users identity and loop until I get a successful response. Sometimes this can take up to 30 minutes when Microsoft's servers are busy.

Once I get a successful response (and a mailbox GUID) I now expect that ALL of Microsoft's servers will see/realize/recognize the GUID on a moving forward basis (the A in ACID although I realize this is not a database). But that's not always the case. And this is why I've added arbitrary sleep's that shouldn't be necessary.

Sometimes when the servers are extremely busy I have to loop for 30 minutes to get a successful exit status/GUID from Get-ExoMailbox.

And every once in a while no matter how long I wait, I'll still get a failure on a subsequent request to "Add-MsolGroupMember" or "Add-UnifiedGroupLinks" when providing the mailbox GUID it's not resolved.

The failures happen about 1 out of 15 times but they do happen. And adding an arbitrary wait doesn't help and really shouldn't be needed.

Once I get a reply back that there's a mailbox GUID (a mailbox has been created) I expect all servers in subsequent commands to recognize that GUID but when it's fresh this isn't always the case because all servers on Microsoft's end have not caught up.. There's no atomicity.

How are other people addressing this inadequacy? If MS Graph API's can't be expected to have consistent replies across servers (ie different requests) how can we be expected to design reliable automation?

Please tell me I'm missing something obvious in my design :)