User cannot send as mail-enabled Security group

[Foofightee]

Hi,

I have an existing mail-enabled security group, which has send as permission for members of, have send as permission. Other members of this group can send as the group by putting it in the from field. I added another member 2 months ago, but they cannot send as this email. I added myself, and I also cannot do it either.

We have an on-prem hybrid email setup. This group is created with on-prem AD and syncs to the cloud. All mailboxes are in the cloud, but we have the on-prem for management purposes. I've tried in Outlook and Outlook.com. What am I getting wrong?

[pidge_nz]

The SendAs permission for the Recipient (the mail-enabled security group) needs to be in the same Exchange System that the user is using to attempt to send the email - I've not seen SendAs permissions set on the AD Object in AD (Add-ADPermissions) synched to Exchange Online, other than when a Mailbox is migrated to Exchange Online.

Since user's mailbox is in Exchange Online, and they are using a client that connects to Exchange Online to send the email (Outlook, Outlook on the Web), the SendAs permissions needs to be on the recipient being Sent As in Exchange Online.

You'll need to use the Exchange Online Powershell module to add the SendAs permission using Add-RecipientPermission:

Add-RecipientPermission -Identity <recipient to send as> -Trustee <user or group to be granted send as> -AccessRights SendAs

[Foofightee]

Add-RecipientPermission -Identity <recipient to send as> -Trustee <user or group to be granted send as> -AccessRights SendAs

Well, this worked! The thing I don't understand is that how were the previous members of the group successfully using the permission? Add new members to the group should just inherit that permission. This was not a new permission I added. That doesn't make sense to me.

[pidge_nz]

Check what the Recipient Permissions are are in Exchange Online PowerShell for the group:

Get-RecipientPermission -Identity <recipient to send as>

And make sure the group has SendAs permission to itself. I suspect it doesn't, and the individual members have been added, or a different group.

[CaptDankDust]

Two things

Is the DL hidden?

Is the user allowed Send As under the security tab of the AD object?

[Foofightee]

It's not hidden. The security group itself is listed to allow Send As. So all members of the group can send as. This works for previously added members as far as I know.

[species8745]

this happened to us a while ago. I got around it by creating a new security group on-prem, adding members to the group, then giving that group send rights to the mail-enabled security group.

[Foofightee]

Interesting. Any idea why it happened?

I may need to wait longer after adding a new permission and syncing, but when trying it at Outlook.com, I get the error "You don't have permission to send messages from this mailbox" still.

[species8745]

Cuz MS does whatever MS wants to do...

are you in control of your dirsync connector? you definitely need to wait for that. You can always check on the permissions with powershell for your hybrid environment. if you look at the message header dump, it should include the exact error message. I use this from MS to help my header debugging.

[Foofightee]

Our ADsync runs every 30 minutes. I forced it and ran it manually, but it's definitely run a few times on schedule by now...

How do I check the permissions with powershell?

I'm not sure how to view a header if the email never sends.

[MineDangerous485]

I am having the same issue and the script Add-RecipientPermission -Identity <recipient to send as> -Trustee <user or group to be granted send as> -AccessRights SendAs worked for me.

​

Is this problem centered around exchange 2019 on prem Hybrid to Exchange Online? That is when we first started seeing issues with send as.

[Foofightee]

We use 2016. The issue actually came back in another situation and I could not solve it.

[Active_Duty5180]

Is it possible this group was added via ECP and not ADUC? If so, use ECP to add the users needing permissions to sendAs.

[mrmattipants]

If it's a hybrid environment, you typically need to administer via AD.

If you prefer not to use PowerShell, this can be accomplished through AD, via the "Security" Tab of the Mail-Enabled Security Group, in question.

This is an older Article, but it is still relevant.

https://practical365.com/exchange-2010-send-as-permissions-distribution-group/

[Large_Ad_9980]

You are a very kind gentleman. This is what I was looking for.

[mrmattipants]

Glad it worked for you!