Mailbox does not share with users's email - Exchange Online Powershell

Abhishek Goyal 246

My situation is - I have created a user on Azure AD with UPN "user.upn@domain.com" and its email is "user.email@domain.com". Then, create one more user with UPN "abhishek.goyal@domain.com" and assign it an exchange license.

After that, I want to share its mailbox with the user with UPN "user.upn@domain.com". The command that I use:

Add-MailboxPermission -Identity abhishek.goyal@domain.com -User user.email@domain.com -AccessRights FullAccess -InheritanceType All

According to Microsoft docs, the possible value that I can provide with -User attributes are:

Name
Alias
Distinguished name (DN)
Canonical DN
Domain\Username
Email address
GUID
LegacyExchangeDN
SamAccountName
User ID or user principal name (UPN)

So, according to that possible values the mailbox has to be shared with the user's email address.

My Output,

If email address is same as UPN then it shared successfully.

If email address is different with UPN then it give error-

Error.png

Please help me with it.

Accepted answer

Yuki Sun-MSFT 41,046 Reputation points Microsoft Vendor

2023-09-13T05:32:48.8666667+00:00
Hi @Abhishek Goyal ,

I have created a user on Azure AD with UPN "user.upn@domain.com" and its email is "user.email@domain.com".

Is the "Email" property added in Azure AD portal? If so, it could be an expected behavior as this doesn't mean the user is already a real mailbox user. While the Microsoft Doc you shared earlier states that, "You can specify the following types of users or groups (security principals) for this parameter:

Mailbox users

Mail users

Mail-enabled security groups (non-mail-enabled security groups are selectable, but they don't work)"

Could you have a look at the Microsoft 365 admin center, find this user and click the Mail tab? If the below warning prompt, please assign an Exchange Online license for this user as well so that it can has a real mailbox:

I just tried testing in my lab tenant by creating a user in Azure AD with UPN "user5@contoso.com" and Email "user5email@contoso.com", I can replicate the error you met when trying to grant user5 the full access permission to another existent user. However, after adding the Exchange Online license for user5, the same command can be ran successfully:

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.

1 person found this answer helpful.
Abhishek Goyal 246 Reputation points

2023-09-13T06:16:40.2+00:00

@Yuki Sun-MSFT

The scenario is as follows: I have two users, user1 and user2. I need to convert user1's mailbox into a shared mailbox and grant mailbox permissions to user2. Initially, user2 does not have an assigned mailbox, so I can grant user1's mailbox permissions to user2 using their UPN and Name, but not their email address. However, after assigning a license to user2, I can then grant user1's mailbox permissions using their UPN, Name, and Email address. Is this supported by Microsoft?

Yuki Sun-MSFT 41,046 Reputation points Microsoft Vendor

2023-09-13T07:05:17.7233333+00:00

Hi @Abhishek Goyal ,

Initially, user2 does not have an assigned mailbox, so I can grant user1's mailbox permissions to user2 using their UPN and Name, but not their email address. However, after assigning a license to user2, I can then grant user1's mailbox permissions using their UPN, Name, and Email address.

I tested further about this scenario, and both are true based on my test results:

The "User" I used here has no assigned license and its Email is different with UPN. As can be seen below, I can grant user1's mailbox permissions to this user using either UPN or Name, but error occurs when using Email address:

And I can verify that the user can access user1's mailbox by login office.com using this user's upn and password, then open user1's mailbox by visiting https://outlook.office.com/owa/user1@contoso.com/?offline=disabled. However, I can not add user1's mailbox in Outlook client using this "delegate's" credentials, it keeps prompting for password. So, seems like this is not a completely valid permission and doesn't work properly from the perspective of Exchange.

If I assign a license to this user, as mentioned in my reply earlier, I can use Email address to grant the full access and everything can work as expected.

Abhishek Goyal 246 Reputation points

2023-09-13T07:10:19.45+00:00

@Yuki Sun-MSFT @Vasil Michev Is this expected behaviour according to Microsoft or is this a kind of bug?

Yuki Sun-MSFT 41,046 Reputation points Microsoft Vendor

2023-09-13T09:27:16.8066667+00:00

Hi @Abhishek Goyal ,

Edited my post above to include my test result (which is not successful) when trying to configure user1's mailbox in Outlook client using the non-licensed user's credentials.

When it comes to whether it's expected or not, based on my understanding and some information in the discussion of this feedback about the user parameter (although the issue is not the same), I assume it's probably more of a by design behavior. When a user has no Exchange license, even if the Add-MailboxPermission cmdlet allows the full access permission to be granted using UPN or name, it cannot work as the supported recipient types listed above.

Taken in the round, agree with Vasil that it's highly recommended to give user2 an Exchange license for everything to work out in your scenario.

Yuki Sun-MSFT 41,046 Reputation points Microsoft Vendor

2023-09-15T07:21:39.06+00:00

Hi @Abhishek Goyal ,

Just checking in to see if you had a chance to see the reply earlier. If the information was helpful, do you mind marking it as a helpful post by clicking on Accept Answer? This can help increase visibility of this question for other members of the Microsoft Q&A community.

And, if you have any further questions do let us know.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

1 additional answer

Vasil Michev 103.7K Reputation points MVP

2023-09-12T17:12:57.7033333+00:00

What you are describing is indeed a supported scenario, the cmdlet should accept any of the email addresses configured on a given mailbox as input for the -User parameter. However, assigning an Exchange license to the user doesn't necessarily mean that a mailbox will be provisioned, in which case Exchange might not "know" about any additional email addresses. In other words, you need to check whether the given address is a valid "recipient", which is easily done via the Get-Recipient cmdlet.
Please sign in to rate this answer.

1 person found this answer helpful.
Abhishek Goyal 246 Reputation points

2023-09-13T04:11:03.78+00:00

@Vasil Michev

The scenario is as follows: I have two users, user1 and user2. I need to convert user1's mailbox into a shared mailbox and grant mailbox permissions to user2. Initially, user2 does not have an assigned mailbox, so I can grant user1's mailbox permissions to user2 using their UPN and Name, but not their email address. However, after assigning a license to user2, I can then grant user1's mailbox permissions using their UPN, Name, and Email address.

Vasil Michev 103.7K Reputation points MVP

2023-09-13T06:17:33.9733333+00:00

Well, that actually confirms my point above. Exchange does not consider the user/mailbox as a valid recipient, so you should double-check the provisioning. Can you see the object when using Get-User? Or this:

Get-User -RecipientTypeDetails user

Abhishek Goyal 246 Reputation points

2023-09-13T06:51:57.39+00:00

@Vasil Michev Got this error

I can see the user object when I use Get-User -Identity "upn"

Vasil Michev 103.7K Reputation points MVP

2023-09-13T06:59:27.07+00:00

$user is a variable, you need the literal "user" value. Anyway, if you see the object in the output of Get-User, but not in Get-Recipients, this confirms my point above - Exchange does NOT consider this a valid recipient, and thus you cannot use identifiers such as email address against it.

Another point to consider is that even though you can add Full access permissions on a regular user (i.e., user2 in your scenario), such users (without a mailbox) cannot access other mailboxes. So to sort the issue and get the expected behavior for the cmdlet as well, you need to provision user2 with a mailbox.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Mailbox does not share with users's email - Exchange Online Powershell

1 additional answer

Your answer