How to Addmailbox permission to serviceprinciple available in the Azure active directory service principal.

Reddy Chanda, Dinesh 0

Hi Team,

How to Addmailbox permission to serviceprinciple available in the active directory, i tried with below command but still unable to do it. The error it says that Add-MailboxPermission is not recognized command and i have installed the all the modules related to the microsoft exchange online but still unable to do it.

Add-MailboxPermission-Identity "

Givary-MSFT 33,311 Reputation points Microsoft Employee

2023-10-10T08:22:51.28+00:00
Hi @Reddy Chanda, Dinesh Thank you for reaching out to us, As I understand you are trying to use the Add-MailboxPermission command to add mailbox permissions to a service principal in Active Directory.

If I understand correct you looking to set permissions in Azure AD or On-premise AD.

To add mailbox permissions to a service principal in Azure AD, you can use the New-ApplicationAccessPolicy command. Here is an example command that you can use:

New-ApplicationAccessPolicy -AccessRight "FullAccess" -AppId <ServicePrincipalAppId> -PolicyScopeGroupId <PolicyScopeGroupId> -Description "Full access to mailbox"

Reference: https://learn.microsoft.com/en-us/powershell/module/exchange/new-applicationaccesspolicy?view=exchange-ps

If my understanding of the issue is incorrect, please let me know or provide more details so that we can assist you.
Reddy Chanda, Dinesh 0 Reputation points

2023-10-10T08:39:41.1+00:00

Hi @Givary-MSFT ,

Thanks for the reply, actually i am running the below command

Add-MailboxPermission - Identity "mymailid@gmail.com" -User "<appid of the application>" -AccessRights FullAccess

But when i run this command on my local machine it gives me the below error, although i have installed all the modules related to the exchange online.

Kindly suggest on this if there is any alternate for this
Givary-MSFT 33,311 Reputation points Microsoft Employee

2023-10-10T08:45:09.0866667+00:00

@Reddy Chanda, Dinesh Re-tagged this post with Exchange online, someone from the Exchange online team will get visibility on this issue.
Aholic Liang-MSFT 13,856 Reputation points Microsoft Vendor

2023-10-18T10:04:49.2466667+00:00

Hi @Reddy Chanda, Dinesh,

Just checking in to see how things are going on with this thread.

If the reply was helpful, you can click the "Accept Answer" button under this post so that other's with similar question can benefit from this thread as well.

If you still have further questions or concerns, feel free to post back.

1 answer

Aholic Liang-MSFT 13,856 Reputation points Microsoft Vendor

2023-10-11T06:35:40.1366667+00:00
Hi @Reddy Chanda, Dinesh,

Add-MailboxPermission - Identity "mymailid@gmail.com" -User "<appid of the application>" -AccessRights FullAccess

The Add-MailboxPermission command is not recognized as a cmdlet, except that connect-exchangeonline needs to be run to connect to exchange online powershell module.

You also need to check that the account currently used to connect to the module has at least the Mail Recipient role.

You can check all roles of the user by referring to the following command:

Get-ManagementRoleAssignment -RoleAssignee <UserIdentity> -Delegating $false | Format-Table -Auto Role,RoleAssigneeName,RoleAssigneeType

-Identity "mymailid@gmail.com"

Please note that the - Identity parameter of the Exchange PowerShell command supports user mailboxes, shared mailboxes, resource mailboxes, and so on in the Exchange environment.
Please sign in to rate this answer.
Aholic Liang-MSFT 13,856 Reputation points Microsoft Vendor

2023-10-25T09:21:21.2433333+00:00

Hi @Reddy Chanda, Dinesh,

Hope things are going well. I am waiting to see if the above information helps. If there's anything else we can help, feel free to let us know.

Cormac Brennan 5 Reputation points

2023-10-26T16:38:06.31+00:00

@Aholic Liang-MSFT I am trying to accomplish the same thing as the original question asker. When I try to run "Add-MailboxPermission -Identity "address@domain.com" -User "<appid of the application>" -AccessRights FullAccess" I get an error: "Write-ErrorMessage : Ex9BC9DD|Microsoft.Exchange.Configuration.Tasks.ManagementObjectNotFoundException|User or group

"<appid of the application>" wasn't found. Please make sure you've typed it correctly."

For <appid of the application> I am using the Application Id (Client Id) of my app registration. I also tried using the Object Id of the corresponding Enterprise Application, but this had the same result. Is there something I'm missing?

Cormac Brennan 5 Reputation points

2023-10-26T16:47:08.33+00:00

@Aholic Liang-MSFT I am trying to accomplish the same thing as the original question asker. When I run Add-MailboxPermission -Identity email@domain.com -User <app id> -AccessRights FullAccess I get an error:

Write-ErrorMessage : Ex9BC9DD|Microsoft.Exchange.Configuration.Tasks.ManagementObjectNotFoundException|User or group "a3d68df5-4762-4f39-8f5e-5641b74c08e1" wasn't found. Please make sure you've typed it correctly.

For <app id> I'm using the Application (client) ID of my app registration. I also tried using the Object ID of the corresponding Enterprise Application. Am I missing something? Thank you for any help you can provide.

Cormac Brennan 5 Reputation points

2023-10-26T17:12:18.9633333+00:00

Never mind. I needed to explicitly create the service principal:

New-ServicePrincipal -AppId <Application (client) ID> -ServiceId <Enterprise Application Object Id>

After I did that I was able to run

Add-MailboxPermission -Identity email@domain.com -User <Enterprise Application Object Id> -AccessRights FullAccess

Jason Fare 0 Reputation points

2024-11-12T15:59:49.28+00:00

Still relevant slight update

In Entra, create App Registration and delegate access to Graph API for the appropriate resource type and access. Record the app registration client ID and find the associated enterprise application (change filter to all applications). Record the object id.

Change to previous answer:

new-serviceprincipal

switch -ServiceId to -ObjectId in future versions.

Full steps from opening In Azure CloudShell:

pwsh Install-Module -Name ExchangeOnlineManagement Connect-ExchangeOnline New-ServicePrincipal -AppId <App Registration (client) ID> -ObjectId <Enterprise Application Object Id> Add-MailboxPermission -Identity email@domain.com -User <Enterprise Application Object Id> -AccessRights FullAccess
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to Addmailbox permission to serviceprinciple available in the Azure active directory service principal.

1 answer

Your answer