Script repository
The script copies Send As permissions from an on-premises Exchange distribution list to its counterpart in Exchange Online. To execute the script, create a business rule, custom command or scheduled task configured for the Group object type.
Only permissions of users who already have a Microsoft 365 account will be copied.
try
{
$groupExchangeId = [Guid]$Context.TargetObject.Get("adm-O365ExchangeObjectId")
}
catch
{
$Context.LogMessage("The group is not mail-enabled in Microsoft 365", "Warning")
return
}
# Get users who have Send As permissions in Exchange on-premises.
$groupParams = $Context.TargetObject.GetMailParameters()
$sendAs = $groupParams.SendAs
if ($sendAs.Count -eq 0)
{
return
}
$sendAsTrustees = @()
for ($i = 0; $i -lt $sendAs.Count; $i++)
{
$object = $sendAs.GetItem($i, [ref]"ADS_PROPERTY_NONE")
$sid = $object.ObjectSid
if ([System.String]::IsNullOrEmpty($sid))
{
continue
}
if (([Softerra.Adaxes.Utils.WellKnownSecurityPrincipalInfo]::IsWellKnown($sid)))
{
continue
}
try
{
$object = $Context.BindToObject("Adaxes://<SID=$sid>")
}
catch
{
continue
}
if ($object.Class -ne "user")
{
continue
}
if (!(($object.RecipientType -eq "ADM_EXCHANGERECIPIENTTYPE_MAILBOXENABLED") -and
($object.RecipientLocation -eq "ADM_EXCHANGERECIPIENTLOCATION_OFFICE365")))
{
continue
}
# Get object ID in Microsoft 365.
$objectId = [Guid]$object.Get("adm-AzureId")
$sendAsTrustees += $objectId.ToString()
}
# Connect to Exchange Online.
$Context.CloudServices.ConnectExchangeOnline()
foreach ($id in $sendAsTrustees)
{
# Grant Send As permissions.
Add-RecipientPermission $groupExchangeId.ToString() -Trustee $id -AccessRights SendAs -Confirm:$False
}
Comments 10
You must be signed in to comment.
Remco Tiel
Hello,
Is this also possible for send on behalf permissions?
Remco
Support
Hello Remco,
How exactly do you want to use the script in terms of Send on Behalf permissions? The thing is that unlike Send As, the Send on Behalf permissions are copied to Exchange Online by means of AAD Connect or DireSync and there is no need to use scripts for this purpose. Any additional details regarding the desired workflow would be very helpful.
Craig Mohr
Works for adding permissions but it does not duplicate them. We need to also have it remove people who have been removed from being able to SendAs a group.
Support
Hello Craig,
Please, take a look at the following script from our repository: https://www.adaxes.com/script-repository/synchronize-send-as-permissions-from-exchange-on-premises-to-exchange-online-for-distribution-list-s580.htm.
Andrew Baker
Is this also for Shared Mailbox as we found that when running it will remove all the users from the sendas list on exchange online and then not add them back even though they have the send-as right
Support
Hello Andrew,
The script should work fine for all Exchange recipients including shared mailboxes. Also, there is no possibility for the script to remove any delegate. All it does is adding Send As delegates in Exchange Online. If you face delegates being removed, make sure there is nothing else executed except for the script.
Oguz
I don't have an on-prem exchange. I just have on-prem AD, Does it still work?
Support
Hello Oguz,
No, the script will not work in this case as there is nothing to copy.
Oguz
Actually, ı have a distribution group on On-Prem AD and I can see it in the Office365 Admin Center as a Distribution Group. I included a user to the security tab as Send As=Allow on the AD.
After that, I run Dirsync and it is a success but I can not send an email. What should I do?
Support
Hello Oguz,
This script is dedicated to copying permissions. That is not something you need. Also, it looks like you are not using Adaxes. You just need to properly configure the mailbox permissions. If you have issues doing that, we recommend you to contact your admins or Microsoft support.