Request for Assistance with Permissions Issue in Exchange Online for Application-Based Management

Question

Dear Azure Support Team,

I am reaching out to request assistance with an ongoing permissions issue impacting my application’s ability to manage Exchange Online resources, specifically with executing Add-DistributionGroupMember and Remove-DistributionGroupMember commands. Despite configuring what appear to be the necessary permissions in Azure Active Directory and Exchange Online, the application continues to encounter insufficient permissions errors when attempting to perform these actions.

Current Configuration:

Application Permissions in Azure AD:

• Exchange.ManageAsApp
  • full_access_as_app
    • Group.ReadWrite.All
      • Directory.ReadWrite.All
        • Other related permissions (detailed if needed)
        Connection Method: The application connects to Exchange Online using App-only authentication with Connect-ExchangeOnline, utilizing an App ID and certificate thumbprint.

Issue Description:

The application has been granted admin consent for the permissions above, yet it encounters errors indicating that it lacks sufficient permissions to modify members within distribution groups. All permissions were reviewed and granted at the tenant level, and the connection is made successfully. However, each attempt to add or remove members from distribution groups fails with a permissions error.

Request:

Could you please help us identify any additional steps, permissions, or configurations required to resolve this issue? If any specific tenant settings or Exchange Online policies need adjustment, kindly provide guidance on how to implement these changes.

Thank you for your support and guidance.

Answer 1

Did you give your app an Exchange Azure role as well?

https://learn.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps#step-5-assign-microsoft-entra-roles-to-the-application

Answer 2

Hi, @Alex Melnik

Just as a supplement to Andy.

1. Make sure that the Identity is already an ExchangeAdministrator
2. Check in the Azure portal as an administrator that the API permissions are properly assigned to the application. Sometimes permission assignments take time to work.
3. Try adding the parameter - BypassSecurityGroupManagerCheck, which can help bypass some security checks that can lead to incorrect permissions. Check out the limitations below.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".