Getting Bed request when converting user mailbox into shared using Powershell

Question

Getting Bed request when converting user mailbox into shared using Powershell

Abhishek Goyal 246

I was trying to convert user mailbox into shared mailbox using powershell command

Set-Mailbox -Identity "example@example.com" -Type Shared

But got the error:

write-Error: {"error":{"code":"BadRequest","message":"Cmdlet needs proxy. Current Server FQDN : DM8PR22MB2759.namprd22.prod.outlook.com,
Required Server FQDN : DS0PR22MB4123.namprd22.prod.outlook.com","innererror":{"message":"Cmdlet needs proxy. Current Server FQDN
: DM8PR22MB2759.namprd22.prod.outlook.com, Required Server FQDN :
DS0PR22MB4123.namprd22.prod.outlook.com","type":"Microsoft.Exchange.Admin.OData.Core.ODataServiceException","stacktrace":"   at
Microsoft.Exchange.AdminApi.CommandInvocation.CommandInvocation.InvokeCommand(QueryContext queryContext, CmdletInvokeInputType
cmdletInvokeInputType)\r\n   at
Microsoft.Exchange.Admin.OData.Core.PathSegmentToExpressionTranslator.Translate(OperationImportSegment segment)\r\n   at
Microsoft.Exchange.Admin.OData.Core.QueryContext.ResolveQuery(ODataContext context, Int32 level)\r\n   at
Microsoft.Exchange.Admin.OData.Core.Handlers.OperationHandler.Process(IODataRequestMessage requestMessage, IODataResponseMessage
responseMessage)\r\n   at Microsoft.Exchange.Admin.OData.Core.Handlers.RequestHandler.Process(Stream requestStream)"}}}

I used ExchangeOnlineManagement Module. For making connection with exchange online I used a azure App with permission Exchange.Manage(Delegated) and login using the user who are Exchange Administrator.

I think my permissions are correct. Please help me out for same.

Appreciate your efforts.

2 answers

Your answer

Answer 1

I believe EXO doesn't handle anchor header properly when dealing with 'Exchange.Manage' tokens. EXO PS uses a default anchor in UPN format, while some commands like 'Set-Mailbox -Type' do not work with it. For sure it's a backend routing issue, but it's possible to override the header and make some particular commands work.

The piece of code worked for me with the latest EXO V3:

$lastConnect = (Get-ConnectionInformation)[-1]
$ctx = [Microsoft.Exchange.Management.ExoPowershellSnapin.ConnectionContextFactory]::GetAllConnectionContexts() | ? { $_.ConnectionId -eq $lastConnect.ConnectionId}
Write-Host "Default anchor:  $($ctx.RoutingHintPrefix):$($ctx.RoutingHint)" 
$mbx = Get-Mailbox -Identity 'example@example.com'
$ctx.RoutingHintPrefix = "MBX"
$ctx.RoutingHint = "$($mbx.ExchangeGuid)@$($lastConnect.TenantID)"
Set-Mailbox -Identity 'example@example.com' -Type Shared

Scott Pettit 0 Reputation points

2023-07-03T10:00:07.3233333+00:00

Also just ran into this problem and your sample code works around it. Have you reported this to Microsoft? If so is there any case id you can share so I can include in my followup?

Answer 2

Vasil Michev 118.1K MVP Moderator

Try logging in directly with the user, using Connect-ExchangeOnline. If the same issue occurs, best open a support case. If the cmdlet works OK, the issue is likely with the way you handle authentication.

Abhishek Goyal 246 Reputation points

2023-05-03T02:50:41.9033333+00:00
I use Connect-ExchangeOnline cmdlet for connection and it connects successfully, also I can get all mailboxes also able to run command for changing alias of mailbox.

Set-Mailbox -Identity "example@example.com" -Alias "example"
Abhishek Goyal 246 Reputation points

2023-05-03T04:53:56.7666667+00:00
@Vasil Michev When I directly logging with user, I am able to do all operations on mailbox. But my requirement is to convert mailbox using access token retrieve using refresh token. I set up an azure app and give delegated permission(Exchange.Manage) on it. It consent from user and they give permission as an Exchange Administrator. But when I run this cmdlet

Set-Mailbox -Identity "example@example.com" -Type Shared

But this command gives me error using that approach.
Vasil Michev 118.1K Reputation points MVP Moderator

2023-05-03T05:52:09.76+00:00

Share the full solution you use for authentication, including the decoded token (you can decode it via jwt.ms or similar).

Abhishek Goyal 246

@Vasil Michev

We are registering an azure app with delegate scope of Exchange.Manage on client side and consent client to give permission on this app. The user who give permission to this app is an exchange administrator. We are getting refresh token and access token from that. I used that access token to connect with exchange online using command

Connect-ExchangeOnline -AccessToken $token -Organization $organization

It successfully connected. I can able to perform all operations on it.

Only set-mailbox cmdlet gets error with Type attribute.

Here is decode token below


{
  "aud": "https://outlook.office365.com",
  "iss": "https://sts.windows.net/<tenant-id>/",
  "iat": 16834529703,
  "nbf": 1683229703,
  "exp": 1683445200,
  "acct": 0,
  "acr": "1",
  "aio": "AVQAq/8TAAAAmr27CLUdsfndslnfdsknfrYOg3h4g/NJSfIAUg8mXfNXAWPIM/XZFVxCfWGc69c/OLsgCihKkNXbuonaKw7OgHPrrkYVNC6Dhge1Ur63kaKn7F5Jbo=",
  "amr": [
    "pwd",
    "mfa"
  ],
  "app_displayname": "Powershell_New_Test",
  "appid": <app-id>,
  "appidacr": "1",
  "enfpolids": [],
  "family_name": "",
  "given_name": "example",
  "ipaddr": <ip_addr>,
  "name": "example",
  "oid": "330bef84-9679-4285-8da7-2f23a269096e",
  "puid": "20032001FD464472",
  "rh": "0.AVoA0sdfdfdy5SYEqqo-iwrtNeOAIAAAAAAPEPzgAAAAAAAABaACc.",
  "scp": "Exchange.Manage User.Read",
  "sid": "124dfc86-ced0-4652-bbf1-186b78e2ea29",
  "sub": "lm1wlDYYOvXDyw0-9Sz8alkplSX0ttB92CqCZgIWk9Q",
  "tid": "cr7044d1-522e-4a60-aaa3-e8b0aed35e38",
  "unique_name": "example@example.com",
  "upn": "example@example.com",
  "uti": "1TZYkCIC5EOpv16oJDAbAA",
  "ver": "1.0",
  "wids": [
    "19232cdf-9323-42fd-ade2-1d097af3e4de",
    "1e930be7-5e62-47db-91af-98c3a49a38b1",
    "1b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3",
    "d79fbf4d-3ef9-4689-8143-76b194e85509"
  ]
}

I think there is some buggy thing in the implementation of this command

Vasil Michev 118.1K Reputation points MVP Moderator

2023-05-03T06:56:37.4533333+00:00

OK, I was able to reproduce this, it does look like an issue with the backend. Let me ping few folks.
Yesh Rajawat 115 Reputation points

2023-05-04T05:37:11.56+00:00

Hi @Vasil Michev ,I was wondering if there have been any updates on the issue that was discussed in this thread? I'm eager to know if there has been any progress made or if there are any new developments
Abhishek Goyal 246 Reputation points

2023-05-10T10:48:15.3233333+00:00

@Vasil Michev Is there any update on that or Should I go with different approach for now?
Vasil Michev 118.1K Reputation points MVP Moderator

2023-05-10T11:44:59.3733333+00:00

I haven't received any useful update on this, sorry. Best open a support case, or use other methods.
Elliot Munro 5 Reputation points

2023-05-31T22:30:21.8466667+00:00

Hi @Vasil Michev , thanks for checking around about this, we're facing the same issue when using a refresh token and Exchange.Manage permissions on the app. Did you happen to get an update on this one?
Revathi Neminathan 0 Reputation points

2023-07-28T13:07:01.52+00:00

@Abhishek Goyal were you able to find out the solution? we're facing same issue with Get-InboxRule
Abhishek Goyal 246 Reputation points

2023-07-28T15:57:09.4533333+00:00

@Revathi Neminathan I couldn't find a viable solution using the OAuth concept. Consequently, I opted for Basic authentication to establish the connection instead.
Abhishek Goyal 246 Reputation points

2023-10-04T05:11:54.35+00:00

@Vasil Michev Is there any update on that?

Share via

Getting Bed request when converting user mailbox into shared using Powershell

2 answers

Your answer