New-MailboxExportRequest error- isn't within your current write scopes

Question

I'm running a command to export the mailbox of a particular user based on some conditions.

Account I'm logged in with is already have role Mailbox Import Export

Command-

New-MailboxExportRequest 
-Mailbox NSS
-ContentFilter {(Sender -eq '@dd.com')} 
-FilePath \\E1\Export\NSS.pst

I successfully exported mailbox for a number of users but when I try to export it for this particular user, I get following error-

'domain.local/domain/Users/SUsers/N SS' isn't within your current write scopes. Can't perform save operation. + CategoryInfo : InvalidArgument: (NSS:MailboxOrMailUserIdParameter) [New-MailboxExportRequest], AD
ScopeException + FullyQualifiedErrorId : [Server=E2,RequestId=c68c16fd-523d-4989-b846-a5072a5ebae6,TimeStamp=11/30/2018 10:32:5 7 PM] [FailureCategory=Cmdlet-ADScopeException] E193E48B,Microsoft.Exchange.Management.RecipientTasks.NewMailboxEx
portRequest + PSComputerName : e2.domain.local

Answer 1

The error indicates that the user that you are trying to use your export command from (your own admin account) does not have sufficient rights to do the operation, likely due to a Role-Based access Control Filter (RBAC).

You should be able to see which RBAC groups that has access to the object with the following command:

Get-ManagementRoleAssignment -WritableRecipient NNS -GetEffectiveUsers

Does your admin account show up on that list?

If you need an RBAC group with access rights to all types of mailboxes and exchange type groups you should be able give an RBAC group access with this:

Set-ManagementScope “ENTER THE RBAC GROUP” -RecipientRestrictionFilter {(RecipientType -eq ‘usermailbox’) -or (recipientType -eq ‘user’) -or (recipientType -eq ‘mailuser’) -or (recipienttype -eq ‘mailcontact’) -or (recipienttype -eq ‘mailuniversaldistributiongroup’) -or (recipienttype -eq ‘mailuniversalsecuritygroup’)}

If you are not the only administrator of this Exchange envoirment you might what to check with your co-admins if there is a reason that the access rights is set up that way or if we are talking about a mistake,