Minimum Permissions Required to Manage Distribution Lists
13 min
The Activate Orchestrator (Job) Service, service account will need the following permissions in Exchange and on the OU(s) where Distribution Lists reside.
Permissions required
Create, Update, and Add user
On-premise Exchange
Grant to:
- Activate Orchestrator service account. See Recommendation below
Grant in:
- On-premise Exchange
Rights:
- Organization Management role
- Or, the Security Group Creation and Membership role A role group may have to be created to grant it, it is normally granted to the Organization Management role group. Without this we get; “A parameter cannot be found that matches parameter name 'Type'”
Grant on:
- OU and all descendant objects
Rights:
- List contents
- Read all properties
- Write all properties
- Read permissions
Cloud-only DLs - Azure
Grant to:
- Activate Microsoft 365 admin account. This can be the synchronised Activate Orchestrator service account, or a new, Entra ID only account created
Grant in:
- Exchange Online
Rights:
- Membership in the Security Group Creation and Membership role A role group will have to be created to grant it, Security Group Creation and Membership is normally granted to the Organization Management role group. A link to a guide on managing Role Groups can be found below. Without this we get; “A parameter cannot be found that matches parameter name 'Type'”
Delete
On-premise Active Directory
Grant to:
- Activate Orchestrator service account.
Grant on:
- OU and all descendant objects
Rights:
- Delete group objects
Cloud-only DLs - Azure
Grant to:
- Activate Microsoft 365 admin account
Grant in:
- Exchange Online
Rights:
- Membership in the Security Group Creation and Membership role
Recommendation
To grant permissions it is recommended to:
- Create a group to assign rights to
- On premise Exchange
- Create a group in an OU that only the Activate Orchestrator service account can write to. See KB Minimum permissions required for the Services Manager module for the rights required on the OU for Activate to manage group membership.
- Hybrid Exchange
- Create a mail-enabled security group in an OU that is synchronised to Azure AD See KB Minimum permissions required for the Services Manager module for the rights required on the OU for Activate to manage group membership.
- Cloud-only
- Create a mail-enabled universal group in Azure AD
- Assign rights listed above to the group
- Create a Service that adds users to the group Ensure that a team with appropriate training to understand the access being requested are approvers for the service.
- Order the service for the Orchestrator service account
Notes:
- If possible, remove permissions for users other than the Activate Orchestrator service account to manage objects in the OU(s).
- A guide to creating a Role Group to grant the Security Group Creation and Membership role can be found at https://learn.microsoft.com/en-us/exchange/permissions-exo/role-groups