I have a management scope and management role assignment set up which allow a service account to impersonate Exchange mailboxes belonging to users in a specified distribution list. I set up the management scope to evaluate whether a user was in the appropriate distribution list using the following Powershell:
New-ManagementScope -Name "ImpersonationScope" -RecipientRestrictionFilter {MemberOfGroup -eq "CN=Impersonated,CN=Users,DC=example,DC=com"}
All of that works as expected, but only considers users who are direct members of the Impersonated list. If I add a new distribution list to the Impersonated list, the service account will not be able to impersonate mailboxes belonging to users on this new list (unless that user is also in Impersonated).
I have determined that I can support multiple groups by either creating multiple scope + role assignment pairs as well as including multiple MemberOfGroup -eq
predicates chained together with -or
operators but would prefer a way to resolve nested groups.
Is there a way I can alter that expression to evaluate a user's group hierarchy recursively?