PowerShell use of Set-DistributionGroup fails in Exchange Online with the following error message:
The operation on Identity xxx failed because it's out of the current user's write scope
I pass BypassSecurityGroupManagerCheck and have assigned the service account running the command, the documented permission:
Security Group Creation and Membership
Add-DistributionGroupMember and Remove-DistributionGroupMember work fine with this setup.
Set-DistributionGroup works too if I assign the Organization Management group role.
I need to know the "least privilege" permissions required to run the command. The feedback loop when adding an Exchange Online permission is around an hour and there is no know way of knowing if the changed permission is in effect, so trial and error is hard.
Does anyone know which permissions are required?