Custom Management Scope permission issue

Question

Hello,

Please excuse me for partially the same question as was posted here, but I'd like to illustrate the whole configuration process and find out what (if) was done wrong.

The theory - Create a custom management scope for In-Place eDiscovery searches

The practice:

Checking:

Testing:

Please note that since the eDiscovery/in-hold tab does appear on Bail's ECP the Test_Discovery_Manager role group assignment has worked correctly.

What's wrong with the scope permissions?

Thank you in advance,
Michael

Answer 1

@Mikhail Firsov
Hi,Michael.
I noticed that you mentioned you are using Exchange 2019 in the former post.
And I tested in my lab (both in Exchange 2019 CU2 and Exchange 2016 CU13) and got the same result.

The problem may be resulted from the distribution group not being resolved correctly into the mailbox addresses of members in this group.
As the error message statued "You don't have sufficient permissions to search the mailbox..."(while actually it's a distribution group) and accroding to this article from Exchange Team Blog.

I suppose that it may be a bug.
As a workaround,you can try manually selecting all specific mailboxes in the distribution group instead of selecting the distribution group directly.
In my test,the search can complete without the permission error.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi KaelYao-MSFT,

Before creating new searches I always check whether the -Filter is working: (I just did not post it):

... I assumed that if the -Filter in Get-Recipient is working then - theoretically - the -RecipientRestrictionFilter in the NewScope cmdlet should also work. Since the search does succeed for a mailbox (not a group!) that is part of the custom scope the assumption was correct. And you right: changing the group to a user mailbox from that group leads to the search creating successfully:

Furthermore, I did see somewhere on technet the article discribing the issue (a bug?) with resolving distribution groups - as far as I see it's exactly the same problem. I just don't remeber that the article contained something like "this issue will be fixed in ...".

I also think this is the bug and administrators must know that this would not work:

Thank you very much for your help!

Regards,
Michael Firsov

Answer 3

P.S. I find it rather serious bug because it's easy to select several users instead of the group name in the test environment but in real networks distribution groups may contain hundreds or thousands members!

Answer 4

Thank you, KaelYao-MSFT!