IdLE.Provider.ExchangeOnline MVP (delegated + app-only; app-only Windows-only)

[blindzero]

Goal

• Provide a production-usable Exchange Online provider for real messaging lifecycle tasks (Leaver scenarios) out of the box.

Scope

• Create new provider module: IdLE.Provider.ExchangeOnline
• Backend: ExchangeOnlineManagement module (documented dependency).
• Authentication (MVP must support both):
  • Delegated (individual admin accounts for audit trail)
  • App-only (certificate-based). For MVP: app-only is Windows-only (documented).
• Capabilities / Features (MVP):
  • Mailbox presence "ensure/report":
    • Detect whether a mailbox exists for the target identity.
    • If not present, fail with actionable reason (e.g., not provisioned/licensing delay) rather than trying to license.
  • Mailbox type:
    • Ensure mailbox type is User or Shared (Leaver conversion User -> Shared).
  • Out of Office (OOO):
    • Ensure automatic replies for User mailboxes only (Disabled/Enabled/Scheduled + internal/external messages + optional schedule).
  • Delegation as entitlements:
    • FullAccess and SendAs (SendOnBehalf is out of MVP scope for now).
    • Support List/Grant/Revoke semantics for these entitlements.
• Idempotency guarantees:
  • Ensure mailbox type is no-op success when already at desired type.
  • OOO ensure is no-op success when already matching desired state.
  • Delegation Grant/Revoke is no-op success when already in desired state.
• Provider must publish its capability list consistently (capabilities are announced, not assumed).

Docs / Examples (part of DoD)

• Document prerequisites and configuration for both auth modes:
  • Delegated: how to connect, required roles/permissions
  • App-only: certificate setup and Windows-only limitation (MVP)
• Provide example workflows (focused on Leaver):
  • Ensure mailbox (report), convert User -> Shared, configure OOO, grant manager access (FullAccess + SendAs)
• Integrate with the single demo runner via -Provider ExchangeOnline.

Acceptance Criteria

• Provider module loads and advertises capabilities.
• MVP features are implemented and covered by unit tests (mocked).
• Idempotency rules above are enforced and test-covered.
• Example workflows run via the demo runner using -Provider ExchangeOnline (documented commands).