Get-RecipientPermission is unrecognized and Get-EXORecipientPermission executes with substantial delay when connected to exchange online using app authentication.

Question

Get-RecipientPermission is unrecognized and Get-EXORecipientPermission executes with substantial delay when connected to exchange online using app authentication.

Ravina Sawant 0

Hi,

While fetching recipient permission for a user using app authentication, Get-RecipientPermission shows unrecognized and Get-EXORecipientPermission executes with delay of 64 seconds. Without using app authentication Get-EXORecipientPermission returns results within milliseconds.

We tried using ExchangeOnline module 3.0.0 and 3.0.1 to execute these commands.

Issue seems to be with app authentication that we need to get resolved.

Is there any permission or any setting given to Azure AD or registered application which can cause this issue?

Commands used to fetch recipient permission :

(shows unrecognized)

Get-RecipientPermission -Identity <mailid> -ResultSize Unlimited | Select-Object -Property Trustee, AccessRights, AccessControlType, IsInherited

(executes with 63 seconds delay)

Get-EXORecipientPermission -Identity <mailid> -ResultSize Unlimited | Select-Object -Property Trustee, AccessRights, AccessControlType, IsInherited

Aholic Liang-MSFT 13,921 Reputation points Microsoft External Staff

2023-08-16T10:04:09.4466667+00:00

Hi @ Ravina Sawant,

Does this issue have any updates?

If it has been resolved, please click "Accept as answer" to mark useful post or share your solution, your action would benefit others who have similar issues.

If you have any questions or need further assistance, please feel free to post back. Thanks!

2 answers

Your answer

Aholic Liang-MSFT 13,921 Reputation points Microsoft External Staff

2023-08-16T10:04:09.4466667+00:00

Hi @ Ravina Sawant,

Does this issue have any updates?

If it has been resolved, please click "Accept as answer" to mark useful post or share your solution, your action would benefit others who have similar issues.

If you have any questions or need further assistance, please feel free to post back. Thanks!

Answer 1

Andy David - MVP 159.8K MVP Volunteer Moderator

Did you follow all the steps here?

https://learn.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps

Answer 2

Roman King 26

I am facing the same problem.
Oh, MS, what did you do ...

Anonymous

2024-11-22T16:43:12.0866667+00:00

I have the same problem , no answer ?

Roman King 26

@Anonymous

Unfortunately, no answers but... Looking for some other not related info I discovered that both Graph and EXO commands have some UNKNOWN :) limits that you can per second. So, there are two things I changed in my script:

switched to 8 parallel streams only
used a tricky collection to store data

So, my script looks like this now and produces 99% no-error results:

$mailboxes = Get-EXOMailbox -ResultSize Unlimited
$totalItems = $mailboxes.Count

$report = [System.Collections.Concurrent.ConcurrentBag[PSCustomObject]]::new()

$mailboxes | Foreach-Object -ThrottleLimit 6 -Parallel {
    function Get-FullAccessPermissions {
        # This function collects FullAccess rights
        param (
            [Parameter(Mandatory = $true)][string]$Mailbox
        )
    
        $result = Get-EXOMailboxPermission -Identity $Mailbox -ErrorAction SilentlyContinue | Where-Object { $_.AccessRights -match "FullAccess" -and $_.User -ne "NT AUTHORITY\SELF" } | Select-Object User
        return $($result.User)
    }

    function Get-SendAsPermissions {
        # This function collects SendAs rights
        param (
            [Parameter(Mandatory = $true)][string]$Mailbox
        )
    
        $result = Get-EXORecipientPermission -Identity $Mailbox -ErrorAction SilentlyContinue | Where-Object { $_.AccessRights -match "SendAs" -and $_.Trustee -ne "NT AUTHORITY\SELF" } | Select-Object Trustee
        return $($result.Trustee)
    }    

    function Get-SendOnBehalfPermissions {
        # This function collects SoB rights
        param (
            [Parameter(Mandatory = $true)][string]$Mailbox
        )
        try {
            $result = Get-EXOMailbox $Mailbox -Properties GrantSendOnBehalfTo | Select-Object -ExpandProperty GrantSendOnBehalfTo | Get-EXOMailbox -ErrorAction SilentlyContinue | Select-Object UserPrincipalName
            return $($result.UserPrincipalName)
        }
        catch {
            return $null
        }
    }

    $record = [PSCustomObject]@{
        "Mailbox"              = $_.UserPrincipalName
        "RecipientType"        = $_.RecipientType
        "RecipientTypeDetails" = $_.RecipientTypeDetails
        "FullAccess"           = (Get-FullAccessPermissions -Mailbox $_.UserPrincipalName) -join "; "
        "SendAs"               = (Get-SendAsPermissions -Mailbox $_.UserPrincipalName) -join "; "
        "SoB"                  = (Get-SendOnBehalfPermissions -Mailbox $_.UserPrincipalName) -join "; "
    }

    $collection = $using:report    
    $collection.TryAdd($record) | Out-Null

    Write-Progress "Processing mailboxes" -Status $_ -PercentComplete ($collection.Count / $using:totalItems * 100)  
}

Anonymous

2024-11-22T17:03:30.8933333+00:00
Thank you very much for your answer!! You saved me

Share via

Get-RecipientPermission is unrecognized and Get-EXORecipientPermission executes with substantial delay when connected to exchange online using app authentication.

2 answers

Your answer