Azure Automation System Assigned Managed Identity Runbook issue with Exchange Online Mail Enabled SG and Entra ID

Question

Hello Everyone,

I have a weird issue that I can't get my head around. I have created a runbook that connects via System Assigned Managed Identity to Exchange Online Management that adds a UPN as a member to a Mail Enabled Security Group ObjectID using the Add-DistributionGroupMember cmdlet.

Param(
[string] $UPN,
[string] $SGM_Group
) 
Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline -ManagedIdentity -Organization "myorg.onmicrosoft.com"

$ExistingMembers = Get-DistributionGroupMember -Identity $SGM_Group -ResultSize Unlimited | Select-Object -ExpandProperty PrimarySmtpAddress

# Check if the user is already a member
if ($ExistingMembers -contains $UPN) {
    Write-Output "$UPN already exists in $SGM_Group"
} else {
    # Add the user to the group
    Add-DistributionGroupMember -Identity $SGM_Group -Member $UPN -BypassSecurityGroupManagerCheck
    Write-Output "$UPN added to $SGM_Group"
}

The powershell script runs without issue and the user is added as a member to the correct group in Exchange. The issue I am having is the user does not show up as a member if I review the group in Entra ID. I need the group membership in Entra ID to match the same group membership in Exchange Online so that we can do memberOf dynamic group memberhip. If I run the command as my global admin on my local workstation the Entra ID and Exchange Online group memberships sync immediately but that isn't useful. We are triggering this runbook as part of a power automate onboarding process so it needs to run using a managed identity. I don't know why a MI initiated powershell runbook updates a mail enabled group membership but refuses to propigate the membership over to ENtra ID. Is this a know bug? Am I missing some permissions for the Managed Identity? The MI has both Exchange Administrative RBAC role and Exchange.ManageAsApp permissions.

Any help would be greatly appreciated!

Thanks,

Cory

Answer 1

Param(

[Parameter(Mandatory=$true)]

[string]$UPN,

[Parameter(Mandatory=$true)]

[string]$SGM_Group

)

Import module and suppress unnecessary warning text

Import-Module ExchangeOnlineManagement -WarningAction SilentlyContinue

Connect using Managed Identity

Connect-ExchangeOnline -ManagedIdentity -Organization "myorg.onmicrosoft.com"

try {

# 1. Fetch existing members safely (handling empty groups)

$ExistingMembers = Get-DistributionGroupMember -Identity $SGM_Group -ResultSize Unlimited -ErrorAction Stop | 

                   Select-Object -ExpandProperty PrimarySmtpAddress

# 2. Check if the user is already a member (handles case-sensitivity safely)

if ($ExistingMembers -and ($ExistingMembers -contains $UPN)) {

    Write-Output "$UPN already exists in $SGM_Group"

} else {

    # 3. Add the user to the group

    Add-DistributionGroupMember -Identity $SGM_Group -Member $UPN -BypassSecurityGroupManagerCheck -ErrorAction Stop

    Write-Output "$UPN added to $SGM_Group"

}

}

catch {

Write-Error "An error occurred: $_"

}

finally {

# Always disconnect to prevent session leaks in automation

Disconnect

-ExchangeOnline -Confirm:$false

}

Answer 2

The issue is resolved. It did turn out to be a permissions issue if anyone else runs into this. The Managed Identity needs the rights to update group membership on the Entra side. I added the Group Administrator RBAC role and it started working immediately.