Help Connecting Azure Automation to Exchange Online - Failed UnAuthorized (UnAuthorized)

Question

Help Connecting Azure Automation to Exchange Online - Failed UnAuthorized (UnAuthorized)

Tyler Johnson 80

Hello,

I'm new to Azure Automation and using Exchange. I have tried over the past week to set and connect this automation up, but have failed and I'm getting quite frustrated. I have tried different scripts by using Google Search, and it always seems to get a different error message.

In my latest version, I get this error: Failed UnAuthorized (UnAuthorized).

I guess I'm missing something in my setup...

Here is the code I'm using.


# 1. Connect to Exchange Online (Use Managed Identity for Azure Automation)
Connect-ExchangeOnline -ManagedIdentity -Organization "email.org"

# 2. Define target Distribution Group identity
$groupName = "JohnsonTest2"

# 3. Import members from a CSV file
$memberList = "Import-Csv C:\Test\JohnsonTest.csv"

# 4. Loop through the list and add members
foreach ($row in $memberList) {
    try {
        Add-DistributionGroupMember -Identity $groupName -Member $row.UserEmail -ErrorAction Stop
        Write-Output "Successfully added $($row.UserEmail)"
    } catch {
        Write-Warning "Failed to add $($row.UserEmail): $($_.Exception.Message)"
    }
}

Tyler Johnson 80 Reputation points

2026-02-23T21:33:27.3133333+00:00

Thank you @Bharath Y P . I followed your steps and got stuck on your third bullet point under the Assign Azure AD Role: section. It seems the "Add assignments" is greyed out for me. What permission/role do I not have?
Bharath Y P 5,620 Reputation points Microsoft External Staff Moderator

2026-02-23T22:04:03.8533333+00:00
Hello Tyler Johnson, Thanks for the update, If the “Add assignments” button is greyed out, it means your account doesn’t have the necessary privileges to assign roles in Microsoft Entra ID. Role assignment is a privileged operation, and only certain admin roles can do it.

To assign Azure AD roles, you must be at least one of these:

Global Administrator

Privileged Role Administrator

If you are only a User Administrator or regular admin, you cannot assign high-level roles like Exchange Administrator.

Assign Microsoft Entra roles - Microsoft Entra ID | Microsoft Learn

Confirm your current role:

Go to Microsoft Entra ID > Roles and Administrators > My roles.

Check if you’re listed as Global Administrator or Privileged Role Administrator.

If not, you’ll need someone with those roles to:

Assign you temporarily to Privileged Role Administrator.

Or directly assign the Automation Account’s managed identity to the Exchange Administrator role.

Once you have the right role, “Add assignments” will be enabled and you can complete the setup.

Run this PowerShell command (if you have Entra module installed):

Get-AzureADDirectoryRole | Where-Object {$_.DisplayName -in @("Global Administrator","Privileged Role Administrator")} | Get-AzureADDirectoryRoleMember

This shows who currently holds the Global Admin or Privileged Role Admin roles.
Tyler Johnson 80 Reputation points

2026-02-24T13:23:40.8333333+00:00

Thank you @Bharath B Y . I will talk with the IT department and report back to you on my progress.
Bharath Y P 5,620 Reputation points Microsoft External Staff Moderator

2026-02-24T13:36:23.91+00:00

Hello Tyler Johnson, Thanks for the update.
Tyler Johnson 80 Reputation points

2026-02-24T18:46:30.45+00:00
Hi @Bharath Y P . I have now been assigned the Privileged Role Administrator and the "add assignment" button is not greyed out any longer. Did I follow your steps correctly?

Also, what is the "ManagedIdentityDisplayName"? is it this?

Add-RoleGroupMember -Identity "Recipient Management" -Member "<ManagedIdentityDisplayName>"
Bharath Y P 5,620 Reputation points Microsoft External Staff Moderator

2026-02-24T19:44:47.3766667+00:00
Hello Tyler Johnson, Thanks for the update. Replace <ManagedIdentityDisplayName> with the display name of a managed identity’s service principal in Azure AD.

To get this:

Go to the specific resource that has a System-assigned Managed Identity (for example, your Automation Account).

On the left-hand menu of the resource, select Identity under the Account Settings section. If it's a System-assigned Managed Identity, ensure it’s Enabled.

On the Identity page, under the System-assigned tab, you will see the Principal ID. This is the unique identifier for the Managed Identity. The Principal ID is also known as the Object ID in some contexts.

and run command az ad sp show --id <principalId> --query displayName in Azure CLI to get the Display name. then use the as

or use Azure CLI and run the below command

# To get principalId az resource show --name <resource-name> --resource-group <resource-group> --resource-type Microsoft.Automation/automationAccounts --query "identity.principalId" --output tsv # To get Display name az ad sp show --id <principalId> --query displayName

This will return the display name of a managed identity’s service principal in Azure AD.
Tyler Johnson 80 Reputation points

2026-02-24T20:53:02.2466667+00:00

Hi @Bharath Y P . I have the Principal ID number, but what is the Azure CLI?

Does getting this name help me connect Azure Automation and Exchange Online? I'm getting lost in all these different steps that have to be done before I can do another step...I have a Powershell script that works on my computer when I manually run it, I just need to create a automated version. sigh. Can I just assign the role right here without having to use code? Would that accomplish the same thing you are trying to get me to do?

<PII Removed>
Bharath Y P 5,620 Reputation points Microsoft External Staff Moderator

2026-02-24T21:08:28.23+00:00
Hello Tyler Johnson, If you have the principle id you can run the above script to get the display name of a managed identity’s service principal in Azure AD so that you can use in the below command in place of ManagedIdentityDisplayName.

Add-RoleGroupMember -Identity "Recipient Management" -Member "<ManagedIdentityDisplayName>"

You can access Azure CLI in your azure portal like below and run the below command to get Display name.

# To get Display name az ad sp show --id <principalId> --query displayName
Tyler Johnson 80 Reputation points

2026-02-24T21:14:36.9233333+00:00

Thank you @Bharath B Y . That was most helpful, however, I'm encountering another error:

<PII Removed>
Bharath Y P 5,620 Reputation points Microsoft External Staff Moderator

2026-02-24T21:25:10.3166667+00:00

Hello Tyler Johnson, We have reached out to you in Private messages. Thanks
Suchitra Suregaunkar 8,635 Reputation points Microsoft External Staff Moderator

2026-02-25T04:06:25.7333333+00:00

Hello @Tyler Johnson,

Kindly let us know if the solution provided via Private Message worked for you.

If you need any further assistance, please feel free to reach out.

Thanks,
Suchitra.

Answer accepted by question author

1 additional answer

Your answer

Tyler Johnson 80 Reputation points

2026-02-23T21:33:27.3133333+00:00

Thank you @Bharath Y P . I followed your steps and got stuck on your third bullet point under the Assign Azure AD Role: section. It seems the "Add assignments" is greyed out for me. What permission/role do I not have?
Bharath Y P 5,620 Reputation points Microsoft External Staff Moderator

2026-02-23T22:04:03.8533333+00:00

Hello Tyler Johnson, Thanks for the update, If the “Add assignments” button is greyed out, it means your account doesn’t have the necessary privileges to assign roles in Microsoft Entra ID. Role assignment is a privileged operation, and only certain admin roles can do it.

To assign Azure AD roles, you must be at least one of these:

Global Administrator

Privileged Role Administrator

If you are only a User Administrator or regular admin, you cannot assign high-level roles like Exchange Administrator.

Assign Microsoft Entra roles - Microsoft Entra ID | Microsoft Learn

Confirm your current role:

Go to Microsoft Entra ID > Roles and Administrators > My roles.

Check if you’re listed as Global Administrator or Privileged Role Administrator.

If not, you’ll need someone with those roles to:

Assign you temporarily to Privileged Role Administrator.

Or directly assign the Automation Account’s managed identity to the Exchange Administrator role.

Once you have the right role, “Add assignments” will be enabled and you can complete the setup.

Run this PowerShell command (if you have Entra module installed):

Get-AzureADDirectoryRole | Where-Object {$_.DisplayName -in @("Global Administrator","Privileged Role Administrator")} | Get-AzureADDirectoryRoleMember

This shows who currently holds the Global Admin or Privileged Role Admin roles.
Tyler Johnson 80 Reputation points

2026-02-24T13:23:40.8333333+00:00

Thank you @Bharath B Y . I will talk with the IT department and report back to you on my progress.
Bharath Y P 5,620 Reputation points Microsoft External Staff Moderator

2026-02-24T13:36:23.91+00:00

Hello Tyler Johnson, Thanks for the update.
Tyler Johnson 80 Reputation points

2026-02-24T18:46:30.45+00:00

Hi @Bharath Y P . I have now been assigned the Privileged Role Administrator and the "add assignment" button is not greyed out any longer. Did I follow your steps correctly?

Also, what is the "ManagedIdentityDisplayName"? is it this?

Add-RoleGroupMember -Identity "Recipient Management" -Member "<ManagedIdentityDisplayName>"
Bharath Y P 5,620 Reputation points Microsoft External Staff Moderator

2026-02-24T19:44:47.3766667+00:00

Hello Tyler Johnson, Thanks for the update. Replace <ManagedIdentityDisplayName> with the display name of a managed identity’s service principal in Azure AD.

To get this:

Go to the specific resource that has a System-assigned Managed Identity (for example, your Automation Account).

On the left-hand menu of the resource, select Identity under the Account Settings section. If it's a System-assigned Managed Identity, ensure it’s Enabled.

On the Identity page, under the System-assigned tab, you will see the Principal ID. This is the unique identifier for the Managed Identity. The Principal ID is also known as the Object ID in some contexts.

and run command az ad sp show --id <principalId> --query displayName in Azure CLI to get the Display name. then use the as

or use Azure CLI and run the below command

# To get principalId az resource show --name <resource-name> --resource-group <resource-group> --resource-type Microsoft.Automation/automationAccounts --query "identity.principalId" --output tsv # To get Display name az ad sp show --id <principalId> --query displayName

This will return the display name of a managed identity’s service principal in Azure AD.
Tyler Johnson 80 Reputation points

2026-02-24T20:53:02.2466667+00:00

Hi @Bharath Y P . I have the Principal ID number, but what is the Azure CLI?

Does getting this name help me connect Azure Automation and Exchange Online? I'm getting lost in all these different steps that have to be done before I can do another step...I have a Powershell script that works on my computer when I manually run it, I just need to create a automated version. sigh. Can I just assign the role right here without having to use code? Would that accomplish the same thing you are trying to get me to do?

<PII Removed>
Bharath Y P 5,620 Reputation points Microsoft External Staff Moderator

2026-02-24T21:08:28.23+00:00

Hello Tyler Johnson, If you have the principle id you can run the above script to get the display name of a managed identity’s service principal in Azure AD so that you can use in the below command in place of ManagedIdentityDisplayName.

Add-RoleGroupMember -Identity "Recipient Management" -Member "<ManagedIdentityDisplayName>"

You can access Azure CLI in your azure portal like below and run the below command to get Display name.

# To get Display name az ad sp show --id <principalId> --query displayName
Tyler Johnson 80 Reputation points

2026-02-24T21:14:36.9233333+00:00

Thank you @Bharath B Y . That was most helpful, however, I'm encountering another error:

<PII Removed>
Bharath Y P 5,620 Reputation points Microsoft External Staff Moderator

2026-02-24T21:25:10.3166667+00:00

Hello Tyler Johnson, We have reached out to you in Private messages. Thanks
Suchitra Suregaunkar 8,635 Reputation points Microsoft External Staff Moderator

2026-02-25T04:06:25.7333333+00:00

Hello @Tyler Johnson,

Kindly let us know if the solution provided via Private Message worked for you.

If you need any further assistance, please feel free to reach out.

Thanks,
Suchitra.

Answer 1

Hello Tyler Johnson, you are running an Azure Automation PowerShell runbook and The runbook uses Exchange Online PowerShell command Connect-ExchangeOnline -ManagedIdentity.

The goal is to add users to a Distribution Group using a CSV file, The runbook fails with: Failed UnAuthorized (UnAuthorized / 401).

Managed Identity authentication works differently from user login. When you use Connect-ExchangeOnline -ManagedIdentity, you are NOT authenticating as your admin user, Global admin or Exchange admin. But You are authenticating as The Azure Automation Account's Managed Identity (Service Principal). Exchange Online does not automatically trust this identity. You must explicitly grant it Exchange permissions. Because of this you are facing error Unauthorized.

The recommendation is to user PowerShell version 7.1 or onwards Azure Automation Runbook Types | Microsoft Learn

To resolve this please follow the below steps. thanks

Use Azure managed identities to connect to Exchange Online PowerShell | Microsoft Learn

Step 1: Enable Managed Identity for the Automation Account

Go to Azure Portal > Automation Account > Identity
Turn System Assigned > Set to “ON”> Click Save
Copy the Object (Principal) ID

Step 2: Assign Azure AD Role:

Go to Azure Portal > Microsoft Entra ID > Roles and Administrators
Assign one of Exchange Administrator (Recommended) OR Global Administrator (for testing only)
Add the Automation Account Managed Identity.

Assign Microsoft Entra roles - Microsoft Entra ID | Microsoft Learn

Step 3: Assign Exchange RBAC Role:

Now connect to Exchange Online manually from your admin machine:

Connect-ExchangeOnline

Find the Managed Identity service principal:

Get-ServicePrincipal | Where-Object {$_.DisplayName -like "*YourAutomationAccountName*"}

Then assign role:

For adding distribution group members, Recipient Management is sufficient:

Add-RoleGroupMember -Identity "Recipient Management" -Member "<ManagedIdentityDisplayName>"

Manage role groups in Exchange Online | Microsoft Learn

Step 4: Grant the Exchange.ManageAsApp API permission for the managed identity to call Exchange Online:

Follow the this document to grant the access Use Azure managed identities to connect to Exchange Online PowerShell | Microsoft Learn

Step 5: Assign Microsoft Entra roles to the managed identity:

Use Azure managed identities to connect to Exchange Online PowerShell | Microsoft Learn

Step 6: Assign Azure AD Role or API Permission

Go Azure portal > Select Microsoft Entra ID (Azure Active Directory).
Click Enterprise Applications (not App Registrations).
At the top, change Application Type filter to All Applications.
Search for the name of your Automation Account > click on your automation account
Select Permissions on left side panel
Click Add API Permission > Office 365 Exchange Online > Application Permissions > select Exchange.ManageAsApp
Click Grant Admin Consent
This ensures the Managed Identity is authorized to connect to Exchange Online.

Step 7: when you are connecting you Exchange model please validate your primary domain

Go Azure portal > Select Microsoft Entra ID (Azure Active Directory).
Overview > check primary domain
This primary domain you have to user when you are connecting to Exchange online using managed identity.

Connect-ExchangeOnline -ManagedIdentity -Organization "<Your primary domain>"

For adding distribution group members, Fix Your Script instead $memberList = "Import-Csv C:\Test\JohnsonTest.csv" you can update this to correct version $memberList = Import-Csv "C:\Test\JohnsonTest.csv"

Note: On your local machine, C:\Test\JohnsonTest.csv exists, so Import-Csv works normally, But in the Azure Automation cloud sandbox, you cannot use local file paths like C:\Test\JohnsonTest.csv. You need a cloud-friendly alternative.

Hope this helps. and please feel free to reach out if you have any further questions. Thanks

Bharath Y P 5,620 Reputation points Microsoft External Staff Moderator

2026-02-26T21:25:47.29+00:00

Hello Tyler Johnson, We glad to hear that your issue is resolved, If the provided answer was helpful, please click Accept the Answer and upvote if the above was helpful.

Thanks

Answer 2

The error message "Failed UnAuthorized (UnAuthorized)" typically indicates that the managed identity you are using does not have the necessary permissions to perform the actions in Exchange Online. Here are some steps you can take to troubleshoot and resolve this issue:

Verify Managed Identity Permissions: Ensure that the managed identity assigned to your Azure Automation account has the necessary roles assigned in Microsoft Entra ID. You can assign roles such as Exchange Administrator to the managed identity to grant it the required permissions to manage distribution groups.
Check API Permissions: Make sure that the Office 365 Exchange Online > Exchange.ManageAsApp API permission is assigned to the managed identity. You can verify this by running the command:
```
   Get-MgServicePrincipal -Filter "AppId eq '00000002-0000-0ff1-ce00-000000000000'"
```
If it returns no results, you may need to register an application in Microsoft Entra ID and assign the necessary permissions as described in the documentation.

Assign Microsoft Entra Roles: If you haven't already, you can assign the required roles to the managed identity using the following command:

   $RoleID = (Get-MgRoleManagementDirectoryRoleDefinition -Filter "DisplayName eq 'Exchange Administrator'").Id
   New-MgRoleManagementDirectoryRoleAssignment -PrincipalId $MI_ID -RoleDefinitionId $RoleID -DirectoryScopeId "/"

Replace $MI_ID with the ID of your managed identity.

Test Connection: After ensuring the permissions are correctly set, try running your script again to see if the issue persists.

By following these steps, you should be able to resolve the unauthorized error and successfully connect your Azure Automation to Exchange Online.

References:

Share via

Help Connecting Azure Automation to Exchange Online - Failed UnAuthorized (UnAuthorized)

1 additional answer

Your answer