Unable to Edit Distribution List Exchange Properties

Question

Hello,

I am trying to do as best as I can researching the best and effective way to manage the properties of Office 365 Exchange Properties with Adaxes (Latest Version) while in an environment using Azure AAD Connect and Microsoft Exchange Online. I do not have an on-prem Exchange Server.

The issue I am facing is that I am not able to edit the exchange properites. Anytime I try manually or with a business rule/scheduled task, I get an error message "Property Require Sender Authentication Enabled cannot be modified in Microsoft 365 because the object is being synchronized from your on-premises organization. In order to be able to modify the property, you need to extend your local Active Directory schema with Exchange attributes." The property name is different depending on what the property is.

I noticed it appears that only AD Distribution Lists are the objects having issues, noting that I can change the MailTip Manually for example, only on users and shared mailbox accounts, but not Distribution Lists. As you can see it failed for the Distribution List:

I have connected my Cloud Tenant using User Authentication, and not as an Application, against a service account with Global Administrator Permissions:

I can see the exchange properties when viewing a Distribution List. I was trying to read up on the requirements in the guide but I cannot find any guides that say I need to set it up one way or the other.

I know other companies use this in the same context, but I am unaware of how exactly they fully intergrate it. Not sure if there is a command or config I missed for adjusting the Distribution Lists.

Comments

Hello,

For troubleshooting purposes, please, do the following:

• Post here or send us at support@adaxes.com a screenshot of the Multi-server environment dialog. The dialog displays how many Adaxes services you have and what their versions are. For information on how to view it, see https://www.adaxes.com/help/MultiServerEnvironment.
• Enable Exchange request logging, reproduce the issue, and check the trace file for corresponding errors/warnings. If you are not sure, you can post the errors/warnings here or send us the entire trace file at support@adaxes.com.

---

I only have 1 Instance:

Here is the output of a successful Mailtip Change on a User/Shared Mailbox:

"[12/19/2023 18:31:50] Set-Mailbox -Identity "Identity ID Removed" -MailTip "test" -Force "True"
[12/19/2023 18:31:51] Succeed"

Here is the output of an attempt at changing the Mailtip on a Distribution List:

[12/19/2023 18:32:34] Get-DistributionGroup -Identity "Identity ID Removed"
[12/19/2023 18:32:34] Succeed
[12/19/2023 18:32:34] Set-DistributionGroup -Identity "Identity ID Removed" -MailTip "test"
[12/19/2023 18:32:35] System.Exception: |System.InvalidOperationException|The operation on Identity "#AllEmployees" failed because it's out of the current user's write scope. The action 'Set-DistributionGroup', 'MailTip', can't be performed on the object 'TestDL' because the object is being synchronized from your on-premises organization. This action should be performed on the object in your on-premises organization.
   at #Dh.#Jh.#l.#5w.#VZc(RunspacePool runspacePool, PSCommand psCommand, String[]& warnings)
   at #Dh.#Jh.#l.#5w.Execute(#Gh command)
   at #Dh.#Fsf.Execute(#Gh command)
   at #ik.#hXe.Execute(#Gh command)

Answer 1

Hello,

Thank you for the provided details. The behavior is expected and is not related to Adaxes itself. The thing is when you create a distribution group with an email address, the Microsoft Entra Connect (former Azure AD Connect) utility synchronizes it and the group becomes a distribution list in Exchange Online. However, the group is considered as synchronized from on-premises, as such it must be managed in on-premises Active Directory. But if the on-premises Active Directory schema is not extended with Exchange properties, it is not possible to modify the Exchange properties either in Exchange Online or in the on-premises Active Directory. To be able to modify the Exchange properties of synchronized distribution groups, your on-premises Active Directory schema must be extended with Exchange attributes.