0

I want an application (e.g. application123) to write a mail on behalf of all users. For this purpose a user is configured within the application (e.g. myImpersoUser).

I want to realize this via ApplicationImpersonation, unfortunately it does not work yet. If I assign the "send_As" permission manually, it works (so SMTP and authentication on the part of the application seems to be ok).

Current setting:

  • AD Security Group (universal) -> App_Mailsender (is a mail-enabled AD group, the same game already tested with a distribution list).

-Management Scope created, which refers to the AD group

New-ManagementScope -Name "S_Mailsend" -RecipientRestrictionFilter {MemberOfGroup -eq "CN=App_Mailsender,OU=X,OU=Y,DC=domainName,DC=local"}

-then RoleAsignment performed

New-ManagementRoleAssignment -Name: "R_Mailsend" -Role:ApplicationImpersonation -CustomRecipientWriteScope: "S_Mailsend" -User: "[email protected]" 

Unfortunately I get the message "550 5.7.60 SMTP; Client does not have permissions to send as this sender".

Where is the error?

1 Answer 1

0

Please check if you have configured your application in order to identify the account to impersonate after configuring impersonation for the specific user: Identify the account to impersonate

Besides, I tried to create a dynamic distribution group, and use the property MemberOfGroup to add members of another dynamic distribution group or distribution group in the recipient filter , so that confirm if the property MemberOfGroup is valid in the recipient filter: enter image description here

enter image description here

However, when I tried to get a list of the dynamic distribution group "DDG02", the output didn't show any results:

enter image description here

Based on the test result, it seems that the MemberOfGroup is not valid in the recipient filter.

If your application has identified the account to impersonate, I think you could add a custom attribute to all members which locate in the group, and use the custom attributes to add these members in the recipient filter of your custom management scope, then create a management scope to include these members and run the New-ManagementRoleAssignment cmdlet to add the permission to impersonate the members of the specified scope:

enter image description here

After that, try using the application to write a mail on behalf of all users and see if there is any difference.

4
  • thanks for your post. Why doesn't the "MemberOfGroup" function work if Microsoft intended it to? Or in which constellations does it work? I don't want to go the way you described, because otherwise I would have to build another script, which regularly checks if new mailboxes exist and have / don't have the attribute. I would prefer a central place (AD group etc.), which regulates the function.
    – user612985
    Jan 19, 2021 at 7:29
  • Hi, based on my knowledge and research, the parameters "-RecipientRestrictionFilter"(docs.microsoft.com/en-us/powershell/module/exchange/…) and "-RecipientFilter"(docs.microsoft.com/en-us/powershell/module/exchange/…) use the same OPath filter syntax and filterable properties, I just to use another command to preview the members in group and see if I could get the group members.
    – Ivan_Wang
    Jan 19, 2021 at 9:29
  • Hello, thank you. But how can I realize this in my way? Without having to resort to the AD attributes (as you described).
    – user612985
    Jan 19, 2021 at 10:00
  • Hi, @user612985, please use the same account that you used to post the question, it's misleading to see two accounts from the same person to interact in the same question. If you need help for your account let me know.
    – yagmoth555
    Jan 19, 2021 at 18:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .