N SS' isn't within your current write scopes.

Question

I am running a command to export a specific user's email based on certain conditions.

The account I used to log in already has the Mailbox Import Export role

Command-

New-MailboxExportRequest 
-Mailbox NSS
-ContentFilter {(Sender -eq '@dd.com')} 
-FilePath \\E1\Export\NSS.pst

I have successfully exported email addresses for many users, but when I tried to export email addresses for this specific user, I received the following error-

'domain.local/domain/Users/SUsers/N SS' isn't within your current write scopes. Can't perform save operation. + CategoryInfo : InvalidArgument: (NSS:MailboxOrMailUserIdParameter) [New-MailboxExportRequest], AD
ScopeException + FullyQualifiedErrorId : [Server=E2,RequestId=c68c16fd-523d-4989-b846-a5072a5ebae6,TimeStamp=9/16/2024 10:32:5 7 PM] [FailureCategory=Cmdlet-ADScopeException] E193E48B,Microsoft.Exchange.Management.RecipientTasks.NewMailboxEx
portRequest + PSComputerName : e2.domain.local

Answer 1

Hello, @Tom1156,

Welcome to the Microsoft Q&A platform!

Based on your description, I understand that you received the error “N SS' isn't within your current write scopes” when you used the New-MailboxExportRequest command to export email addresses for a specific user.

The error indicates that the user that you are trying to use your export command from (your own admin account) does not have sufficient rights to do the operation, likely due to a Role-Based access Control Filter (RBAC).

To resolve your issue, I suggest you use the following command to see if your administrator account is in the RBAC group that has access to the object.

Get-ManagementRoleAssignment -WritableRecipient NNS -GetEffectiveUsers

If not, and you need an RBAC group with access rights to all types of mailboxes and exchange type groups you should be able give an RBAC group access with this:

Set-ManagementScope “ENTER THE RBAC GROUP” -RecipientRestrictionFilter {(RecipientType -eq ‘usermailbox’) -or (recipientType -eq ‘user’) -or (recipientType -eq ‘mailuser’) -or (recipienttype -eq ‘mailcontact’) -or (recipienttype -eq ‘mailuniversaldistributiongroup’) -or (recipienttype -eq ‘mailuniversalsecuritygroup’)}

One point to note is, if you are not the only administrator of this Exchange environment you might what to check with your co-admins if there is a reason that the access rights is set up that way.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thank you for your support and understanding.

Best Wishes,

Alex Zhang