---
title: Minimum Permissions Required to Manage Distribution Lists
slug: minimum-permissions-required-to-manage-distribution-lists
createdAt: 2025-07-28T03:39:50.511Z
---

The Activate Orchestrator (Job) Service, service account will need the following permissions in Exchange and on the OU(s) where Distribution Lists reside.

# Permissions required

## Create, Update, and Add user

### On-premise Exchange

:::Heading{depth="3" indent="1"}
Grant to:
:::

- Activate Orchestrator service account.
   See Recommendation below

:::Heading{depth="3" indent="1"}
Grant in:
:::

- On-premise Exchange

:::Heading{depth="3" indent="1"}
Rights:
:::

- Organization Management role
- Or, the Security Group Creation and Membership role
   A role group may have to be created to grant it, it is normally granted to the Organization Management role group.
   Without this we get; “A parameter cannot be found that matches parameter name 'Type'”

:::Heading{depth="3" indent="1"}
Grant on:
:::

- OU and all descendant objects

:::Heading{depth="3" indent="1"}
Rights:
:::

- List contents
- Read all properties
- Write all properties
- Read permissions

### Cloud-only DLs - Azure

:::Heading{depth="3" indent="1"}
Grant to:
:::

- Activate Microsoft 365 admin account.
   This can be the synchronised Activate Orchestrator service account, or a new, Entra ID only account created

:::Heading{depth="3" indent="1"}
Grant in:
:::

- Exchange Online

:::Heading{depth="3" indent="1"}
Rights:
:::

- Membership in the Security Group Creation and Membership role
   A role group will have to be created to grant it, Security Group Creation and Membership is normally granted to the Organization Management role group. A link to a guide on managing Role Groups can be found below.
   Without this we get; “A parameter cannot be found that matches parameter name 'Type'”

## Delete

### On-premise Active Directory

:::Heading{depth="3" indent="1"}
Grant to:
:::

- Activate Orchestrator service account.

:::Heading{depth="3" indent="1"}
Grant on:
:::

- OU and all descendant objects

:::Heading{depth="3" indent="1"}
Rights:
:::

- Delete group objects

### Cloud-only DLs - Azure

:::Heading{depth="3" indent="1"}
Grant to:
:::

- Activate Microsoft 365 admin account

:::Heading{depth="3" indent="1"}
Grant in:
:::

- Exchange Online

:::Heading{depth="3" indent="1"}
Rights:
:::

- Membership in the Security Group Creation and Membership role 

# Recommendation

To grant permissions it is recommended to:

- Create a group to assign rights to
  1. On premise Exchange
     - Create a group in an OU that only the Activate Orchestrator service account can write to.
       See KB Minimum permissions required for the Services Manager module for the rights required on the OU for Activate to manage group membership.
  2. Hybrid Exchange
     - Create a mail-enabled security group in an OU that is synchronised to Azure AD
       See KB Minimum permissions required for the Services Manager module for the rights required on the OU for Activate to manage group membership.
  3. Cloud-only
     - Create a mail-enabled universal group in Azure AD
- Assign rights listed above to the group
- Create a Service that adds users to the group
   Ensure that a team with appropriate training to understand the access being requested are approvers for the service.
- Order the service for the Orchestrator service account

# Notes:

- If possible, remove permissions for users other than the Activate Orchestrator service account to manage objects in the OU(s).
- A guide to creating a Role Group to grant the Security Group Creation and Membership role can be found at https\://learn.microsoft.com/en-us/exchange/permissions-exo/role-groups