azureazure-active-directoryexchange-server

Incorrect permissions

I've created a runbook in Azure Automation that runs a few commands including the following:

Add-MailboxPermission -Identity $shared_mailbox -User $mailbox_user -AccessRights FullAccess -Confirm:$false
Write-Output  "Granting full access permission..."
Add-RecipientPermission -Identity $shared_mailbox -Trustee $mailbox_user -AccessRights SendAs -Confirm:$false
Write-Output  "Granting full send permission..."

However when running the Add-RecipientPermission Cmdlet it throws the following error.

|Microsoft.Exchange.Data.Directory.InsufficientPermissionsException|Source server:xxxx.prod.exchangelabs.com doesn't have write permission to target DC:xxxx.PROD.OUTLOOK.COM. Usually it indicates that target forest isn't an account partition of source forest. Additional information: Access is denied. Active directory response: 00000005: SecErr: DSID-03152E13, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

I've given it Exchange Admin permissions to the service account which is why add-mailbox permission works, but unsure why the second command does not work

Answer (updated 28th May 2025)

Thank you @Rukmini, your answer did help but I think I had to do something slightly differently. It has been almost one year now.

These are the API permissions I gave - Image for API permissions for azure/entra app

Then I used a certificate for authentication to be used in the azure runbook. Certificate image

Then I uploaded the certificate to the azure runbook and imported it like this

# Import the ExchangeOnlineManagement module
Import-Module ExchangeOnlineManagement

# Retrieve the certificate from Azure Automation
$automationCertificate = Get-AutomationCertificate -Name 'Portal-Automation'

# Connect to Exchange Online using the certificate and Tenant ID
Connect-ExchangeOnline -CertificateThumbprint 'cert-thumbprint' -AppId "app-id" -Organization "yourorg.onmicrosoft.com"

At this point I was able to get it to work, I think I've missed some steps. Basically the use case was calling this runbook from a power automate workflow to automate exchange admin tasks.

Solution

  • I created an Azure AD Application and granted API permissions like below:

    enter image description here

    Now I created the Service Principal using below commands:

    Connect-AzureAD
Connect-ExchangeOnline
$app = Get-AzureADApplication -SearchString 'TestExchangeApp'
$sp = Get-AzureADServicePrincipal -SearchString $app.DisplayName
$sp1 = New-ServicePrincipal -AppId $app.AppId -ServiceId $sp.ObjectId -DisplayName "Exchange Service Principal for $($app.DisplayName)"

    enter image description here

    Now, Add-MailboxPermission and Add-RecipientPermission commands worked successfully like below:

    Add-MailboxPermission -Identity "user1@xxxx.onmicrosoft.com" -User $sp1.ServiceId -AccessRights FullAccess

Add-RecipientPermission -Identity "user1@xxx.onmicrosoft.com" -Trustee "user@xxx.onmicrosoft.com"  -AccessRights SendAs

    enter image description here enter image description here

    If you want to assign permission to the Service Account, check the below:

    You can check what Exchange Command needs which permissions:

     Get-ManagementRole -Cmdlet Add-RecipientPermission
 
 Get-ManagementRoleAssignment -Role "Mail Recipients" -Delegating $false | Format-Table -Auto Role,RoleAssigneeType,RoleAssigneeName

    enter image description here

    Hence to resolve the error, assign Recipient Management/Organization Management role to the user like below:

    enter image description here

    Reference:

    Permissions in Exchange Online