Unable to Send As for Distribution Group" in Exchange Hybrid environment

Question

Hi
we have a hybrid Exchange Environment with Exchange Server 2019 (recently migrated from 2013) i have a group of users in a DG which are able to send as this certain DG when choosing "From" in Outlook via the Address Book.
However we have added one new user to this same DG which is unable to send as this group when choosing "From" via the Address Book.

The group resides in our local AD and can only be managed from our on-prem exchange / Exchange 2019 ECP.
In ECP there where no 'group delegations' set for any user but i have added the new usere here via PowerShell running:
Get-DistributionGroup "DG" | Add-ADPermission -User "******@mycompany.com" -ExtendedRights "Send As" &
Set-DistributionGroup -Identity "DG" -GrantSendOnBehalfTo "******@mycompany.com" I was not able to set this rights via on-prem ECP because Office 365 mailboxes cannot be choosen...

The Error Message he receives:

Your message did not reach some or all of the intended recipients.

      Subject:	1 2 1 2
      Sent:	13/04/2023 16:52

The following recipient(s) cannot be reached:

      XXXXXXXXX on 13/04/2023 16:52
            This message could not be sent. You do not have the permission to send the message on behalf of the specified user. 

__________________________________________________

Diagnostic information for administrators:
__________________________________________________

Error is [0x80070005-0x000004dc-0x00000524].

Exchange response headers:
	request-id: 3f18ca70-d297-73d1-f826-da0af80f7319
	X-ServerApplication: Exchange/15.20.6298.030
	X-FEServer: LO2P265CA0195
	X-BEServer: VI1PR01MB7133
	X-CalculatedBETarget: VI1PR01MB7133.eurprd01.prod.exchangelabs.com
	X-RequestId: {A7E4257B-D5C2-4733-8898-D691F38510BA}:43
	X-ClientInfo: {C7E5C661-DCF5-4AE6-9B53-E354A4D9C882}:239360023
	X-ElapsedTime: 173
	X-BackEndHttpStatus: 200
	X-ResponseCode: 0
	X-DiagInfo: VI1PR01MB7133
	X-RequestType: Execute
__________________________________________________

ROPs Summary:

	0: ropSetProps (10) Processed(1) Completed(0)
		ROP result: 0
		Response codes: 0
	1: ropSetProps (10) Processed(1) Completed(0)
		ROP result: 0
		Response codes: 0
	2: ropFlushRecipients (14) Processed(1) Completed(0)
		ROP result: 0
		Response codes: 0
	3: ropSetProps (10) Processed(1) Completed(0)
		ROP result: 0
		Response codes: 0
	4: ropTransportSend (74) Processed(1) Completed(0)
		ROP result: 0
		Response codes: 1244
__________________________________________________

Response Exceptions:

ROP Index: 4
ROP Associated: ropTransportSend (74)
Microsoft.Exchange.Data.Storage.SendAsDeniedException: Can't send message. ---> Microsoft.Mapi.MapiExceptionSendAsDenied: MapiExceptionSendAsDenied: Unable to send message. (hr=0x80070005, ec=1244)
0.35250:28020000, 1.36674:01000000, 1.61250:00000000, 1.45378:02000000, 1.44866:00000000, 1.36674:01000000, 1.61250:00000000, 1.45378:05000000, 1.44866:00000000, 1.36674:7A000000, 1.61250:00000000, 1.45378:08000000, 1.44866:00140000, 1.36674:0A000000, 1.61250:00000000, 1.45378:19000000, 1.44866:C6240000, 1.36674:0E000000, 1.61250:00000000, 1.45378:E2240000, 1.44866:2F020000, 16.55847:57140000, 17.43559:0000000034020000000000000000000000000000, 20.52176:140F9A981E00001015000000, 20.50032:140F9A988E17F01FA4000000, 0.53414:12000000, 0.35180:14000000, 255.23226:15000000, 255.27962:7A000000, 255.27962:0A000000, 255.27962:0E000000, 255.31418:36000000, 0.35250:68020000, 1.36674:0A000000, 1.61250:00000000, 1.45378:02000000, 1.44866:1E000000, 1.36674:4A000000, 1.61250:00000000, 1.45378:23000000, 1.44866:00000000, 16.55847:84000000, 17.43559:00000000D0030000000000004E00000000000000, 20.52176:140F9A981E0000007B000000, 20.50032:140F9A988E1770200A007100, 0.53414:96000000, 0.35180:86020000, 255.23226:0A00D280, 255.27962:0A000000, 255.27962:4A000000, 255.17082:DC040000, 0.44949:B0000000, 4.21921:DC040000, 255.27962:FA000000, 255.1494:B5000000, 0.38698:05000780, 1.41134:46000000, 0.37692:86000000, 0.44092:86000000, 0.40348:86000000, 0.34608:62000100, 0.55056:62000100, 0.42768:C4F57800, 0.56112:86000000, 0.52807:86000000, 1.41134:46000000, 4.33016:DC040000, 7.40748:010000000000010B29807000, 7.57132:000000000000000086000000, 4.39640:DC040000, 1.63016:4A000000, 8.45434:A7889D4BFB169146827B46E65D225DDE2D626265, 1.46798:13000000, 5.10786:0000000031352E32302E363239382E3033303A564931505230314D42373133333A34326530383333362D623864622D343463312D613463662D6262656235376439303162653A3130393838383A2E4E455420362E302E313500000000, 7.51330:6B2E17AF2E3CDB0800000000, 0.39570:12000000, 1.55954:0A000000, 1.33010:0A000000, 2.54258:00000000, 0.40002:07000000, 1.56562:00000000, 1.33010:0A000000, 2.54258:00000000, 0.40002:0C000000, 1.56562:00000000, 1.64146:4A000000, 1.33010:4A000000, 2.54258:DC040000, 1.33010:4A000000, 2.54258:DC040000, 255.1750:EA020000, 255.31418:0A00773A, 0.22753:48010000, 255.21817:DC040000, 0.34722:0A00763A, 4.51106:DC040000, 0.41890:F4020000, 4.58274:DC040000, 0.59285:1400883F, 4.46997:DC040000
   at Microsoft.Mapi.MapiExceptionHelper.InternalThrowIfErrorOrWarning(String message, Int32 hresult, Boolean allowWarnings, Int32 ec, DiagnosticContext diagCtx, Exception innerException, MapiStore mapiStore)
   at Microsoft.Mapi.MapiExceptionHelper.ThrowIfError(String message, Int32 hresult, IExInterface iUnknown, Exception innerException, MapiStore mapiStore)
   at Microsoft.Mapi.MapiBase.ThrowIfError(String message, Int32 hr)
   at Microsoft.Mapi.MapiMessage.TransportSendMessage(PropValue[]& propsToReturn)
   at Microsoft.Exchange.Data.StoreObjects.MapiAccessorExtensionMethods.TransportSendMessage(IStoreSession storeSession, Object mapiObject, ExTimeZone timezone, PropValue[]& mapiPropValues)
   --- End of inner exception stack trace ---
   at Microsoft.Exchange.Data.StoreObjects.MapiAccessorExtensionMethods.TransportSendMessage(IStoreSession storeSession, Object mapiObject, ExTimeZone timezone, PropValue[]& mapiPropValues)
   at Microsoft.Exchange.Data.Storage.CoreItem.TransportSend(PropertyDefinition[]& properties, Object[]& values)
   at Microsoft.Exchange.RpcClientAccess.Handler.Message.TransportSend()
   at Microsoft.Exchange.RpcClientAccess.Handler.RopHandler.<>c__DisplayClass156_0.<TransportSend>b__0()
   at Microsoft.Exchange.RpcClientAccess.Handler.ExceptionTranslator.TryExecuteCatchAndTranslateExceptions[TResult](Func`1 protectedCode, Func`2 errorCodeExtractor, Boolean noThrow, TResult& result, Exception& exception, ErrorCode& errorCode)


Transport-Send failed: failure enum(25), HResult(0x00000000), EC(1244).
Transport-Send failed: failure enum(22), HResult(0x00000000), EC(1244).
Submit-Message failed: message id(1), failure enum(13), HResult(0x80070005), EC(1244).

Answer 1

Where are the mailboxes that will be sending as this group? If they are in Exchange Online, then you need to add the send as permissions there to the synced on-prem group using Exchange Online Powershell: Identity = the synced group in Exchange Online Trustee = 365 mailbox https://learn.microsoft.com/en-us/exchange/permissions