Permissions error upon running Add-DistributionGroupMember PS cmdlet on Exchange Online

user_12994829 0
Viewed 630

I'm currently trying to automate the user creation in Azure AD, and addition to a distribution group in Exchange Online using a PowerShell script. I've followed this guide for that - I've set up an app registration with a certificate and that's how I'm authenticating to both Azure AD and Exchange Online - without human intervention.

The specific Exchange cmdlet I'm running in the script (for the EXO part) is Add-DistributionGroupMember -member "user@domain.com" -identity "dlist" -BypassSecurityGroupManagerCheck, and once I run it I receive the following error output:

Active Directory operation failed on XXXXXXXXXXXXXXX.XXXXXXXXXXX.PROD.OUTLOOK.COM. This error is not retriable. Additional information: Insufficient access rights to perform the operation.
Active directory response: 00002098: SecErr: DSID-XXXXXXXX, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
    + CategoryInfo          : NotSpecified: (:) [Add-DistributionGroupMember], ADOperationException
    + FullyQualifiedErrorId : [Server=XXXXXXXXXXXXX,RequestId=8ac3130a-4bbe-41a0-b062-4768b6f51234,TimeStamp=1/3/2021 2:18:13 PM] [FailureCategory=Cmdlet-ADOperationException] XXXXXXX,Microsoft.Exchange.Management.RecipientTasks.AddDistribu
   tionGroupMember
    + PSComputerName        : outlook.office365.com

Other cmdlets such as Get-Mailbox work correctly, but this specific one is giving me problems constantly. I've tried giving all API permissions I can think of in Azure to the application, both Delegated and Application permissions, and yet I'm still facing the error. Here's the current full list and I've had no success whatsoever:

I also tried replacing some of the Delegated permissions with Application permissions to no avail either. I tried assigning a variety of roles to the application as mentioned in the article too and every single time I get that Insufficient access rights to perform the operation error.

Could someone tell me why? Where and how am I supposed to grant the necessary permissions for the app to add a user to a distribution (mailing) list?

I've been searching around and found no answer to it for that last few days. Any help would be greatly appreciated.

azure-active-directory exchange-server azure powershell
2 Answers

Based on my test, adding Exchange.ManageAsApp Application permission and assigning Exchange Service administrator role is enough.

Create the AAD app with adding Exchange.ManageAsApp Application permission.

$appName = 'Exo_V2_App'

$api = (Get-AzureADServicePrincipal -Filter "AppID eq '00000002-0000-0ff1-ce00-000000000000'")

$permission = $api.AppRoles | Where-Object { $_.Value -eq 'Exchange.ManageAsApp' }

$apiPermission = [Microsoft.Open.AzureAD.Model.RequiredResourceAccess]@{
    ResourceAppId  = $api.AppId ;
    ResourceAccess = [Microsoft.Open.AzureAD.Model.ResourceAccess]@{
        Id   = $permission.Id ;
        Type = "Role"
    }
}

$myApp = New-AzureADApplication -DisplayName $appName -ReplyUrls 'http://localhost' -RequiredResourceAccess $apiPermission

$mySP = New-AzureADServicePrincipal -AppID $myApp.AppID

$myApp | Format-List DisplayName,ObjectID,AppID

Assign the service principal to Exchange Service administrator role.

$directoryRole = 'Exchange Service Administrator'

$RoleId = (Get-AzureADDirectoryRole | Where-Object {$_.displayname -eq $directoryRole}).ObjectID

Add-AzureADDirectoryRoleMember -ObjectId $RoleId -RefObjectId $mySP.ObjectID -Verbose

You can try to create a new clean Azure AD app without adding additional configuration to have a test.

user_105217390

If I am not wrong, you should be part of the ManagedBy of the group before adding the members.

Step 1 :

First execute one of the below commands :

Set-DistributionGroup <NameOfGroup> -ManagedBy "<Your Alias>" -BypassSecurityGroupManagerCheck

Or :

Set-DistributionGroup Accounting -ManagedBy @{Add="< Your Alias>"} -BypassSecurityGroupManagerCheck

Step 2 :

Then execute the command to add the user to the group.

Add-DistributionGroupMember -Identity <NameOfGroup> -Member user@contoso.com
user_137552460
Related