Share via

send on behlaf of mailbox permission in Exchange Hybrid

dirkdigs 921 Reputation points
2021-12-08T21:39:36.54+00:00

Hello we have a mailbox located in Exchange server 2019
We have Hybrid connection to Exchange online
The user who is located in ExO cannot use the 'send of behalf' of permission for the mailbox that is located in On-prem.
If i browse the mailbox in EAC and go to the mailbox delegates section it does not allow ,me to select the user who has been migrated . it's not even an option .
how to enable this ??
thank you

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,503 questions
Microsoft Exchange Hybrid Management
Microsoft Exchange Hybrid Management
Microsoft Exchange: Microsoft messaging and collaboration software.Hybrid Management: Organizing, handling, directing or controlling hybrid deployments.
1,999 questions
0 comments
Accepted answer
  1. Andy David - MVP 145.6K Reputation points MVP
    2021-12-08T21:52:07.777+00:00

    So here you have to use on-prem Exch Powershell and grant that way:
    https://learn.microsoft.com/en-us/powershell/module/exchange/set-mailbox?view=exchange-ps 

    set-mailbox <onPremMailbox> -GrantSendOnBehalfTo <ExOMailbox>

    Then wait till it syncs to Azure and Exchange Online.

    after that it should work

    https://learn.microsoft.com/en-us/exchange/permissions#mailbox-permissions-supported-in-hybrid-environments
    156081-image.png

    0 comments

4 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. dirkdigs 921 Reputation points
    2021-12-08T22:14:50.967+00:00

    did a sync and was a no go .

    here is the error .

    Your message did not reach some or all of the intended recipients.

      Subject:  TEST
  Sent:     12/8/2021 4:09 PM

    The following recipient(s) cannot be reached:

      user1  on 12/8/2021 4:09 PM
  user2 on 12/8/2021 4:09 PM
        This message could not be sent. You do not have the permission to send the message on behalf of the specified user.

    Diagnostic information for administrators:

    Error is [0x80070005-0x000004dc-0x00000524].

    Exchange response headers:
    request-id: b0db2971-9345-e708-2386-f2b8d86b5dfc
    X-ServerApplication: Exchange/15.20.4755.022
    X-FEServer: CH2PR10CA0016
    X-BEServer: YT3PR01MB6629
    X-CalculatedBETarget: YT3PR01MB6629.CANPRD01.PROD.OUTLOOK.COM
    X-RequestId: {D4D5F084-6E18-41F7-BB33-D1E6629AF931}:78
    X-ClientInfo: {5D1C959C-DE8B-4185-97C3-A31D1698C932}:153800032
    X-ElapsedTime: 156
    X-BackEndHttpStatus: 200
    X-ResponseCode: 0
    X-DiagInfo: YT3PR01MB6629
    X-RequestType: Execute

    ROPs Summary:

        0: ropSetProps (10) Processed(1) Completed(0)
            ROP result: 0
            Response codes: 0
    1: ropSetProps (10) Processed(1) Completed(0)
            ROP result: 0
            Response codes: 0
    2: ropFlushRecipients (14) Processed(1) Completed(0)
            ROP result: 0
            Response codes: 0
    3: ropSetProps (10) Processed(1) Completed(0)
            ROP result: 0
            Response codes: 0
    4: ropTransportSend (74) Processed(1) Completed(0)
            ROP result: 0
            Response codes: 1244

    Response Exceptions:

    ROP Index: 4
    ROP Associated: ropTransportSend (74)
    Microsoft.Exchange.Data.Storage.SendAsDeniedException: Can't transport send message. ---> Microsoft.Mapi.MapiExceptionSendAsDenied: MapiExceptionSendAsDenied: Unable to transport send message. (hr=0x80070005, ec=1244)
    0.35250:0A008E80, 1.36674:01000000, 1.61250:00000000, 1.45378:02000000, 1.44866:00000000, 1.36674:01000000, 1.61250:00000000, 1.45378:05000000, 1.44866:00000000, 1.36674:7A000000, 1.61250:00000000, 1.45378:08000000, 1.44866:00140000, 1.36674:0A000000, 1.61250:00000000, 1.45378:19000000, 1.44866:EE0A0000, 1.36674:0E000000, 1.61250:00000000, 1.45378:0A0B0000, 1.44866:A4020000, 16.55847:DB070000, 17.43559:0000000034020000000000000000000000000000, 20.52176:140F93921600101000000000, 20.50032:140F93928617101000000000, 0.35180:75000000, 255.23226:00000000, 255.27962:7A000000, 255.27962:0A000000, 255.27962:0E000000, 255.31418:00000000, 0.35250:410E0000, 1.36674:0A000000, 1.61250:00000000, 1.45378:02000000, 1.44866:18000000, 1.36674:4A000000, 1.61250:00000000, 1.45378:1D000000, 1.44866:00000000, 16.55847:7E000000, 17.43559:00000000C0030000000000000000000000000000, 20.52176:140F93921600101077000000, 20.50032:140F939286171010B10E0000, 0.35180:00000000, 255.23226:9C000000, 255.27962:0A000000, 255.27962:4A000000, 255.17082:DC040000, 0.44949:2B0F0000, 4.21921:DC040000, 255.27962:FA000000, 255.1494:00000000, 0.38698:46000000, 1.41134:46000000, 7.36354:010000000037BC4A86000000, 0.37692:86000000, 0.44092:1A010480, 0.41232:00000000, 0.60208:1A010480, 0.37136:05000780, 0.34608:00000000, 0.55056:05000780, 0.42768:05000780, 0.56112:00000000, 0.52807:05000780, 1.41134:46000000, 4.33016:DC040000, 7.40748:010000000037BC4A1A010480, 7.57132:00000000000000001A010480, 1.63016:4A000000, 4.39640:DC040000, 8.45434:0B33CE7CEF99654FBD2BF62C8DCB385301000000, 1.46798:13000000, 5.10786:0000000031352E32302E343735352E3032323A595433505230314D42363632393A30646136363235622D613838372D343437342D396662642D3066613937333539366533313A32353535303800FF40100F010480, 7.51330:934AA34697BAD9080F010480, 0.39570:0F010480, 1.55954:0A000000, 0.49266:02000000, 1.33010:0A000000, 2.54258:00000000, 0.40002:7A000000, 1.56562:00000000, 1.64146:4A000000, 1.33010:4A000000, 2.54258:DC040000, 255.1750:E1000000, 255.31418:40000A67, 0.22753:0A005581, 255.21817:DC040000, 0.34722:0B00F410, 4.51106:DC040000, 0.41890:EF000000, 4.58274:DC040000, 0.59285:0201030F, 4.46997:DC040000
    at Microsoft.Mapi.MapiExceptionHelper.InternalThrowIfErrorOrWarning(String message, Int32 hresult, Boolean allowWarnings, Int32 ec, DiagnosticContext diagCtx, Exception innerException, MapiStore mapiStore)
    at Microsoft.Mapi.MapiExceptionHelper.ThrowIfError(String message, Int32 hresult, IExInterface iUnknown, Exception innerException, MapiStore mapiStore)
    at Microsoft.Mapi.MapiBase.ThrowIfError(String message, Int32 hr)
    at Microsoft.Mapi.MapiMessage.TransportSendMessage(PropValue[]& propsToReturn)
    at Microsoft.Exchange.Data.StoreObjects.MapiAccessorExtensionMethods.TransportSendMessage(IStoreSession storeSession, Object mapiObject, ExTimeZone timezone, PropValue[]& mapiPropValues)
    --- End of inner exception stack trace ---
    at Microsoft.Exchange.Data.StoreObjects.MapiAccessorExtensionMethods.TransportSendMessage(IStoreSession storeSession, Object mapiObject, ExTimeZone timezone, PropValue[]& mapiPropValues)
    at Microsoft.Exchange.Data.Storage.CoreItem.TransportSend(PropertyDefinition[]& properties, Object[]& values)
    at Microsoft.Exchange.Data.StoreObjects.CoreItemMetricLogger.TransportSend(PropertyDefinition[]& properties, Object[]& values)
    at Microsoft.Exchange.RpcClientAccess.Handler.Message.TransportSend()
    at Microsoft.Exchange.RpcClientAccess.Handler.RopHandler.<>c__DisplayClass156_0.<TransportSend>b__0()
    at Microsoft.Exchange.RpcClientAccess.Handler.ExceptionTranslator.TryExecuteCatchAndTranslateExceptions[TResult](Func1 protectedCode, Func2 errorCodeExtractor, Boolean noThrow, TResult& result, Exception& exception, ErrorCode& errorCode)

    Transport-Send failed: failure enum(25), HResult(0x00000000), EC(1244).
    Transport-Send failed: failure enum(22), HResult(0x00000000), EC(1244).
    Submit-Message failed: message id(1), failure enum(13), HResult(0x80070005), EC(1244).

    0 comments
  2. Joyce Shen - MSFT 16,651 Reputation points
    2021-12-09T06:30:50.327+00:00

    Hi @dirkdigs

    According to your information above, your issue seems to be related to outlook cache.

    1. Try to clear the autocomplete cache before sending email with delegator account. Navigate to File > Options > Mail, under Send messages option, click Empty Auto-Complete List. After clearing operation, type the sender’s email address manually via clicking From > Other E-mail Addresses.
    2. You could try creating a new profile for this user
    3. If you remove the current Outlook profile and re-create it, the error persists. This appears mostly because the GAL in your Outlook isn't updating

    Try to update the address book by going to the Send/Receive tab and click on Send-Receive Groups > Download Address Book. After clicking on OK, now try sending again from Outlook using your shared mailbox. Also, try taking the FROM address from the Global Address list instead of the GAL.

    Close Microsoft Outlook and try deleting everything within the "Offline Address Books" folder.
    location : C:\Users\Username\AppData\Local\Microsoft\Outlook

    Re-launch Outlook and try again. After updating OAB, there are high chances that the error is fixed.

    Another thread discussed the similar issue resolved by removing all email accounts and data files other than the user's own primary email account.
    Open Outlook> File> Info> Account Settings
    After removing all other accounts, then +Add Account to add them back in.

    And this link discusses the similar issue for your reference as well: You do not have the permission to send the message on behalf of the specified user
    Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

    If an Answer is helpful, please click "Accept Answer" and upvote it.

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments
  3. dirkdigs 921 Reputation points
    2021-12-09T17:00:45.017+00:00

    @Andy David - MVP

    Just to confirm , are these PowerShell commands not required? they are different then the one-liner you posted.

    156352-image.png

    Also , I had the user try in OWA and they got the following error :

    156278-image.png

    0 comments
  4. Andy David - MVP 145.6K Reputation points MVP
    2021-12-09T18:06:44.593+00:00

    Thats for send-as. If you want to grant that, you can. But send of behalf is different.

    0 comments