Office 365 – Allowing Users to Edit Exchange Groups They Manage

Exchange Hybrid and Directory Synchronization provide for the most full-featured integration experience with your on-premises messaging environment. Users, for the most part, are unaware of whether their mailbox is in the cloud or on-premises.
There are, however, a few limitations with Exchange Hybrid and Directory Synchronization.
One of these limitations is around distribution groups that have had managers assigned for administrative purposes. If you have users that manage their own distribution groups via Outlook, you’ll find that this functionality does not work once the group manager has been moved to Exchange Online. This limitation should hopefully not come as a surprise, it’s a topic I discuss with my clients during every Exchange Online engagement. It is also an issue where unfortunately there are not a lot of great options for resolution.
Below are some options that can help mitigate this issue in at least some scenarios.

Background

The basic source of the issue is that when you’re using Directory Synchronization, objects are authored in your on-premises Active Directory. The synchronization to Office 365 is essentially “one-way” such that any change to a distribution group has to be made in Active Directory and then synced to Office 365.
Your Office 365 users are connecting to a cloud copy of the Global Address List (GAL) and as a result, cannot make changes to that copy. Thus, they cannot use Outlook to edit distribution groups that they are the manager of.
Trying to edit a distribution group via Outlook will result in the error below:

So now that using Outlook to manage on-premises distribution groups is not an option, we either push all that work back to the help desk or Exchange admins or we need to find another way.

Ways to Delegate Distribution Group Management

First, we need to determine how the permissions have been assigned in your environment. There are several ways that you can delegate “self-management” of distribution groups. The way in which the delegation has been made will determine your options for management.
Three common methods of distribution group delegation are:

• Active Directory delegations by Organizational Unit (OU)
• Populating the “Managed By” tab on the Active Directory object
• Populating the Exchange “Managed By” or “Owner” field for the object

Method #1: Active Directory delegations by Organizational Unit (OU)
In this scenario, you perhaps have an OU that you’ve delegated out “Full Control” or other AD permissions to a set of regional admins or departmental admins. As part of this delegation, distribution groups within that OU inherit those AD permissions.
Method #2: Populating the “Managed By” tab on the Active Directory object
This would be assigning a single user on the “Managed By” tab of the Active Directory object and checking the box that says “Manager can update membership list”. This populates the “managedBy” attribute on the group and grants the manager the “Write Members” permission on the group. Keep in mind this field is singular and only one user can be selected as the manager.

Method #3: Populating the Exchange “Managed By” or “Owner” field for the object
Within the Exchange management tools, you can assign multiple users to the “Managed By” (Exchange 2010) or “Owner” (Exchange 2013) fields. These translate to the “msExchCoManagedByLink” attribute on the group object which is multi-valued. Interestingly, when populating multiple users as the group manager, the first one alphabetically is actually populated into the “managedBy” attribute and the rest go into the “msExchCoManagedByLink” attribute. However, the “Manager can update membership list” option is not checked on the group so the managers do not appear on the group’s ACL.

Options for Management

For self-management of distribution groups, it can be done via native Active Directory tools or the native Exchange tools. While there are some third-party tools out there that can assist, there’s not a specific tool I would endorse and they are outside the scope of this article.

Unleash the Potential of Power Platform With a Center of Excellence

Business innovation often comes from within. Discover how to empower innovation from non-traditional developers with the Microsoft Power Platform.

Learn More

Managing via Active Directory Tools
As an Administrator, you’d likely just pop open “Active Directory Users and Computers” but that’s not exactly something your end users are going to do. There’s a Microsoft KB article that covers one of the options for end users: “Owners of an on-premises distribution group that’s synced to Office 365 can’t manage the distribution group in Exchange Online“.
Basically, the article says the user can run the following command:

This does in fact work and we could probably even make it a bit more user-friendly by creating a shortcut for the user. This method should also work whether the user’s mailbox is in the cloud or on-premises but again, only works for groups where they’ve been delegated the rights in Active Directory.

Managing via Exchange Tools
If your users have previously been using Outlook to manage the groups that they own, this is where issues arise once their mailbox is migrated to Exchange Online. Outlook is no longer an option which leaves us with the Exchange Admin Center (EAC) in Exchange 2013. Through a little bit of Role Based Access Control (RBAC), we can grant users the ability to manage their distribution groups using the on-premises EAC.

Configuring RBAC for the Exchange 2013 EAC

This is dependent upon having an on-premises Exchange 2013 EAC; so it’s suitable in hybrid environments or in environments where you’ve held onto your Exchange 2013 server for management purposes (like this).
At a high-level, we’re going to do the following:

• Create a new “Manage-MyDGs” role from an existing role
• Remove any commands that allow actions other than updating existing groups
• Create a new role group and assign it our new role
• Change the write scope of the role assignment such that it only applies to groups that the user is set as the owner of in Exchange

This isn’t meant to be a primer on RBAC in Exchange; for more information on RBAC, check out “Understanding Role Based Access Control“.
Here are the commands:

Adding a user to the new “Self-Managed Distribution Group Management” in Active Directory will now allow the user to manage any distribution groups that they own via the EAC.
Logging into your on-premises EAC URL (“https://vdir/ECP”), they see the following:

It is important to note that users will actually see all distribution groups, not just the ones they manage. However, if they attempt to manage a group that they are not the owner of, they’ll receive an error that the group “isn’t within your current write scopes” and they “can’t perform save operation”.
While perhaps not as easy as updating groups via Outlook, it does allow you to enable your cloud users to manage their own on-premises distribution groups via a fairly intuitive web interface.

What about the Exchange 2010 ECP?

Unfortunately, I have not been able to reproduce the same functionality in the Exchange 2010 ECP. The RBAC works if the user’s mailbox in on-premises or if they don’t have a mailbox, neither of which solves our issue. Once the mailbox is in the cloud, the user receives an error when trying to access the ECP.

Looking Forward

I would like at some point to see Microsoft add more options when using Directory Synchronization. In particular, for organizations that have never had Exchange but are using Directory Synchronization, it would be nice to be able to author Exchange attributes in the cloud and use the native toolset. It seems like it would be easy enough to have a checkbox in Azure ADSync or the tenant that says “I have no on-premises Exchange or I want to author Exchange attributes in the cloud”.
However, with what we have today, the above is one way that you can help hand the self-management of groups back to your users.

Summary

• Cloud users cannot manage on-premises distribution groups via Outlook
• The method used to delegate access to the group will determine the options for management
• Groups assigned management permissions via Exchange can be managed in the EAC
• RBAC can be used to allow users to access the Exchange 2013 EAC for group management

Did you find this article helpful?
Leave a comment below or follow me on Twitter (@JoePalarchio) for additional posts and information on Office 365.
Looking to do some more reading on Office 365?
Catch up on my past articles here: Joe Palarchio.